Vulnerabilities in Wikimedia Foundation
152 resultsCVE-2025-23081MEDIUMVarious security vulnerabilities in Extension:DataTransferEPSS 0.2%CVE-2026-100238MEDIUMFlow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSSEPSS 0.2%CVE-2026-39839MEDIUMStored XSS through URLs in Cargo's map formatEPSS 0.2%CVE-2025-61656NONEXSS when pasting into VEEPSS 0.2%CVE-2026-34095NONEaction=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript requestEPSS 0.2%CVE-2025-61648NONEStored XSS through system messages in CheckUserEPSS 0.2%CVE-2025-61655NONEStored XSS through system messages in VisualEditorEPSS 0.2%CVE-2026-34094LOWCustomized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefixEPSS 0.2%CVE-2026-39841MEDIUMStored XSS through list fields on Cargo's page values and Special:CargoTablesEPSS 0.2%CVE-2026-39840MEDIUMCSS injection in multiple Cargo display formatsEPSS 0.2%CVE-2026-100245MEDIUMStored XSS on Wikibase Special:SetSiteLink via unescaped system messageEPSS 0.2%CVE-2026-100243MEDIUMStored XSS in WikiSEO author and image properties on action=infoEPSS 0.2%