CVE-2025-53485highCWE-862

CVE-2025-53485: high-severity vulnerability in Wikimedia Foundation Mediawiki - SecurePoll…

SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes

Published · Updated

Follow this CVE+ Monitor Mediawiki - SecurePoll extension

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.3%
SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Wikimedia Foundation · Mediawiki - SecurePoll extension
Related CVEs — Wikimedia Foundation Mediawiki - SecurePoll…

In the same product, most dangerous first.

CVE-2025-53484CRITICALSecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped inputEPSS 0.5%CVE-2025-53483HIGHSecurePoll: Multiple admin actions vulnerable to Cross-Site Request ForgeryEPSS 0.2%