CVE-2025-49579mediumCWE-79

CVE-2025-49579: medium-severity vulnerability in StarCitizenTools mediawiki-skins-Citizen

Citizen allows stored XSS in menu heading message

Published

Follow this CVE+ Monitor mediawiki-skins-Citizen+ Monitor starcitizentools/citizen-skin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected products
StarCitizenTools · mediawiki-skins-Citizen
Related CVEs — StarCitizenTools mediawiki-skins-Citizen

In the same product, most dangerous first.

CVE-2024-36123MEDIUMCitizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:TaglineEPSS 0.5%CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2025-62508MEDIUMCitizen vulnerable to stored XSS in sticky header button messagesEPSS 0.4%CVE-2025-49578MEDIUMCitizen allows stored XSS in user registration date messageEPSS 0.4%CVE-2025-49576MEDIUMCitizen allows stored XSS in search no result messagesEPSS 0.4%CVE-2025-49575MEDIUMCitizen allows stored XSS in Command Palette tip messagesEPSS 0.4%