Vulnerabilities in Wikimedia Foundation
152 resultsCVE-2025-11261NONEStored i18n XSS exposed by security patch for T402077EPSS 0.3%CVE-2026-100244HIGHCentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)EPSS 0.3%CVE-2025-67483NONETheoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levelsEPSS 0.3%CVE-2025-67480NONElist=allrevisions can be used to bypass Extension:LockdownEPSS 0.3%CVE-2025-67481NONEmw.message(…).parse() doesn't output safe HTML, but it's being used as if it doesEPSS 0.3%CVE-2025-61639LOWSuppressed blocked IP is visible in Special:BlockList, RC, and other placesEPSS 0.3%CVE-2025-61642NONEStored XSS through system messages provided to CodexHtmlFormsEPSS 0.3%CVE-2025-61637NONEStored XSS through system messages in MW CoreEPSS 0.3%CVE-2025-53490MEDIUMMultiple XSS in CampaignEventsEPSS 0.3%CVE-2025-53489MEDIUMXSS in GoogleDocs4MWEPSS 0.3%CVE-2025-61640NONEStored XSS through system messages in Special:RecentChangesLinked (MW Core)EPSS 0.3%CVE-2026-5266LOWExposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo.
This vulnerability is associated wiEPSS 0.2%CVE-2025-7363MEDIUMTitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser functionEPSS 0.2%CVE-2025-67477NONEStored XSS through a system message in Special:ApiSandboxEPSS 0.2%CVE-2026-5762MEDIUMReportIncident DiscussionTools integration causes slow requestsEPSS 0.2%CVE-2026-34086LOWAbuseFilter misuses ::userCanBitfield, exposing access-controlled informationEPSS 0.2%CVE-2025-61636NONECodex Special:Block vulnerable to message key XSSEPSS 0.2%CVE-2025-67475NONEStored XSS through edit summaries in MW CoreEPSS 0.2%CVE-2026-0671MEDIUMMultiple stored i18n/message-key XSSes in UploadWizardEPSS 0.2%CVE-2025-23079MEDIUMXSSes in Extension:ArticleFeedbackv5EPSS 0.2%