CVE-2025-21612highCWE-79CWE-80

CVE-2025-21612: high-severity vulnerability in StarCitizenTools mediawiki-extensions-TabberNeue

Cross-site Scripting in TabberTransclude in Extension:TabberNeue

Published · Updated

Follow this CVE+ Monitor mediawiki-extensions-TabberNeue+ Monitor starcitizentools/tabber-neue

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.5%
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected products
StarCitizenTools · mediawiki-extensions-TabberNeue
Related CVEs — StarCitizenTools mediawiki-extensions-TabberNeue

In the same product, most dangerous first.

CVE-2025-53093HIGHTabberNeue vulnerable to Stored XSS through wikitextEPSS 0.4%