Vulnerabilities in The Wikimedia Foundation
98 resultsCVE-2025-62700MEDIUMStored XSS through a system message in MultiBoilerplateEPSS 0.3%CVE-2025-62698MEDIUMStored XSS through system messages in ExternalGuidanceEPSS 0.3%CVE-2026-96873MEDIUMReflected XSS in CirrusSearch debug explain outputEPSS 0.3%CVE-2026-96878MEDIUMCargo Exhibit field alias allows stored XSSEPSS 0.3%CVE-2026-96876MEDIUMAnonymous reflected XSS in CargoExport invalid-alias errorsEPSS 0.3%CVE-2026-96877MEDIUMReflected XSS through Cargo Drilldown full-text searchEPSS 0.3%CVE-2026-96875MEDIUMReflected XSS in Cargo Drilldown hierarchy filtersEPSS 0.3%CVE-2026-103444LOWStored XSS through system messages in WikiForumEPSS 0.3%CVE-2026-39934MEDIUMGrowth Experiments ReassignMenteesJob runs as an infinite loopEPSS 0.3%CVE-2024-47840MEDIUMStored XSS through sidebar in Apex skinEPSS 0.3%CVE-2026-58517MEDIUMBlocked users can create and edit WikiLambda objectsEPSS 0.3%CVE-2026-103446HIGHWikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragmentsEPSS 0.3%CVE-2026-103437LOWReadingLists imported metadata permits JavaScript URL XSSEPSS 0.3%CVE-2025-62654LOWStored XSS through system messages in QuizGameEPSS 0.3%CVE-2025-62653LOWStored XSS through system messages in PollNYEPSS 0.3%CVE-2025-62655LOWSQL injection in Cargo via Special:CargoExportEPSS 0.3%CVE-2026-103445LOWStored XSS through PageForms #autoedit redirect linksEPSS 0.3%CVE-2026-103585LOWattacker-controlled javascript license URL via XSSEPSS 0.3%CVE-2026-14358MEDIUMStored XSS in Wikimedia Chart pie tooltip via Data:*.tab field titleEPSS 0.3%CVE-2025-62659LOWThe CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectorsEPSS 0.3%