Vulnerabilities in The Wikimedia Foundation
98 resultsCVE-2025-62695MEDIUMStored XSS through system messagesEPSS 0.4%CVE-2025-62701MEDIUMStored XSS through system messagesEPSS 0.4%CVE-2025-62702MEDIUMStored XSS through system messagesEPSS 0.4%CVE-2025-62668MEDIUMInsufficient permission checks in action=growthsetmentorEPSS 0.4%CVE-2025-32075MEDIUMIP and user agent leaks in Extension:TabsEPSS 0.4%CVE-2025-32076MEDIUMEvil regex used to process user-provided data in VisualDataEPSS 0.4%CVE-2024-47847MEDIUMVarious XSSes found in CargoEPSS 0.4%CVE-2025-32079MEDIUMSaving the right content to MediaWiki:GrowthMentors.json can take down the siteEPSS 0.4%CVE-2024-47845MEDIUMCSS sanitizer used incorrectly, and is easily bypassedEPSS 0.4%CVE-2025-32077MEDIUMXSSes in Extension:SimpleCalendarEPSS 0.4%CVE-2025-32078MEDIUMXSSes and potential RCE in Special:VersionCompareEPSS 0.4%CVE-2025-12004CRITICALThe compare API module breaks Extension:LockdownEPSS 0.4%CVE-2025-62652MEDIUMStored XSS in WebAuthn key nameEPSS 0.4%CVE-2026-22714LOWi18n XSS, DoS and config SQLI in MonacoEPSS 0.4%CVE-2025-62699MEDIUMSpecial:Translate tool does not use the correct IP and User-Agent in the CheckUser toolEPSS 0.4%CVE-2025-62661MEDIUMDo permission checking when getting counts of global and local edits, new articles and thanksEPSS 0.4%CVE-2026-39933MEDIUMMultiple XSS vulnerabilities in GlobalWatchlistEPSS 0.3%CVE-2025-62697HIGHImproperly sanitized style parameter in LanguageSelectorEPSS 0.3%CVE-2026-96872LOWWikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositionsEPSS 0.3%CVE-2025-62700MEDIUMStored XSS through a system message in MultiBoilerplateEPSS 0.3%