The Wikimedia Foundation Mediawiki - GrowthExperiments Extension vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting The Wikimedia Foundation Mediawiki - GrowthExperiments Extension: 4 record(s), with affected versions and fixes.
CVE-2026-39934
Medium · 6.9
CWE-835 Apr 7, 2026
Growth Experiments ReassignMenteesJob runs as an infinite loop
Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue was remediated only on the `master` branch.
CVE-2026-22713
Medium · 5.4
CWE-79 Jan 8, 2026
Stored XSS through edit summaries in GrowthExperiments
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GrowthExperiments Extension: 1.45, 1.44, 1.43, 1.39.
CVE-2025-62668
Medium · 6.9
CWE-276 Oct 18, 2025
Insufficient permission checks in action=growthsetmentor
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
CVE-2025-62667
Medium · 6.9
CWE-79 Oct 18, 2025
Stored XSS through article extracts in GrowthExperiments
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.