The Wikimedia Foundation vulnerabilities

Published CVEs affecting The Wikimedia Foundation products: 181 record(s), with severity, exploitation and fixes.

MediaWiki 45 Mediawiki - Cargo Extension 15 CheckUser 9 Mediawiki - WikiLambda Extension 7 Mediawiki - CentralAuth Extension 5 Mediawiki - Wikibase Extension 4 Mediawiki - GrowthExperiments Extension 4 MediaWiki - UploadWizard extension 3 AbuseFilter 3 Vector 2 Timeline 2 VisualEditor 2 Mediawiki - CirrusSearch Extension 2 MediaWiki PageForms extension 2 Scribunto 2 Mediawiki - PageTriage Extension 2 OATHAuth 2 Mediawiki - TemplateSandbox Extension 2 Mediawiki - CampaignEvents Extension 2 MediaWiki - ProofreadPage Extension 2 Mediawiki - Wikilove Extension 2 Mediawiki - Translate Extension 2 Mediawiki - Charts Extension 1 Mediawiki - UrlShortener Extension 1 Mediawiki - Thanks Extension 1 Mediawiki - UserPageViewTracker Extension 1 Wikipedia Android App 1 SyntaxHighlight GeSHi 1 CentralAuth 1 OAuth 1 UrlShortener 1 Mediawiki - RedirectManager Extension 1 MediaWiki CookieConsent extension 1 Mediawiki - Wikistories 1 Mediawiki - Skin:BlueSky 1 Mediawiki - Collection extension 1 MediaWiki MediaSearch extension 1 MediaWiki CommonsMetadata extension 1 MediaWiki Wikbase extension 1 MediaWiki Wikistories extension 1

Exploited only (KEV) →

CVE-2026-100241 High · 7.5 CWE-200 Sep 29, 2026

Private change tags exposed to anonymous users via revision-tags-change events

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.

CVE-2026-100240 Critical · 9.1 CWE-862 Sep 29, 2026

TemplateSandbox does not check read permissions for the page being previewed

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-100238 Medium · 6.1 CWE-79 Sep 29, 2026

Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-100383 Medium · 4.8 CWE-79 Sep 25, 2026

Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

CVE-2026-100382 Critical · 10.0 CWE-78 Sep 25, 2026

Unauthenticated remote code execution through wikitext in ExternalData

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

CVE-2026-100381 Medium · 5.3 CWE-79 Sep 25, 2026

UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-96879 Medium · 6.9 CWE-212 Sep 25, 2026

"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.

CVE-2026-100380 Medium · 5.3 CWE-79 Sep 25, 2026

Reflected XSS in Wikibase Special:SetLabel language validation

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-100379 Medium · 5.3 CWE-200 Sep 25, 2026

Cross-request disclosure of CentralAuth cookies in Wikipedia Android App

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main.

CVE-2026-100378 Medium · 5.3 CWE-862 Sep 25, 2026

Missing permission check in the Translate sandbox doRemind action

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-100377 Medium · 6.9 CWE-200 Sep 25, 2026

Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

CVE-2026-100376 Medium · 4.8 CWE-79 Sep 25, 2026

TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-96878 Medium · 6.9 CWE-79 Sep 25, 2026

Cargo Exhibit field alias allows stored XSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVE-2026-96877 Medium · 6.9 CWE-79 Sep 25, 2026

Reflected XSS through Cargo Drilldown full-text search

CVE-2026-96876 Medium · 6.9 CWE-79 Sep 25, 2026

Anonymous reflected XSS in CargoExport invalid-alias errors

CVE-2026-96875 Medium · 6.9 CWE-79 Sep 25, 2026

Reflected XSS in Cargo Drilldown hierarchy filters

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVE-2026-100237 Medium · 6.1 CWE-79 Sep 25, 2026

Stored i18n XSS in the Flow integration of Thanks

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.

CVE-2026-96874 Low · 2.3 CWE-79 Sep 25, 2026

Stored XSS in Cargo Drilldown tab names

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVE-2026-96873 Medium · 5.5 CWE-79 Sep 24, 2026

Reflected XSS in CirrusSearch debug explain output

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.

CVE-2026-96872 Low · 2.9 CWE-280 Sep 23, 2026

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

CVE-2026-14363 Critical · 9.8 CWE-89 Jul 1, 2026

Cargo Extension: SQLi in Special:Drilldown

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

CVE-2026-58517 Medium · 4.3 CWE-288 Jul 1, 2026

Blocked users can create and edit WikiLambda objects

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

CVE-2026-14358 Medium · 6.1 CWE-79 Jul 1, 2026

Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.

CVE-2026-58521 Critical · 9.8 CWE-89 Jul 1, 2026

SQLi in Cargo extension via year range filter

CVE-2026-58520 Medium · 6.1 CWE-601 Jul 1, 2026

UrlShortener defaults to ineffective validation open to third-party redirects

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.