CVE-2025-61637: vulnerability in Wikimedia Foundation MediaWiki
Stored XSS through system messages in MW Core
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 0epss 0.3%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Affected products
Wikimedia Foundation · MediaWikiRelated CVEs — Wikimedia Foundation MediaWiki
In the same product, most dangerous first.
CVE-2013-4572—CVE-2013-4572EPSS 2.1%CVE-2013-4303—CVE-2013-4303EPSS 1.5%CVE-2013-6455—CVE-2013-6455EPSS 1.1%CVE-2013-6451—CVE-2013-6451EPSS 1.1%CVE-2025-6597NONEMediaWiki should not consider autocreation as login for the purposes of security reauthenticationEPSS 0.5%CVE-2025-6927LOWAutoblocks from global account suppressions are publicly visibleEPSS 0.5%