The Wikimedia Foundation vulnerabilities

Published CVEs affecting The Wikimedia Foundation products: 181 record(s), with severity, exploitation and fixes.

MediaWiki 45 Mediawiki - Cargo Extension 15 CheckUser 9 Mediawiki - WikiLambda Extension 7 Mediawiki - CentralAuth Extension 5 Mediawiki - Wikibase Extension 4 Mediawiki - GrowthExperiments Extension 4 MediaWiki - UploadWizard extension 3 AbuseFilter 3 Vector 2 Timeline 2 VisualEditor 2 Mediawiki - CirrusSearch Extension 2 MediaWiki PageForms extension 2 Scribunto 2 Mediawiki - PageTriage Extension 2 OATHAuth 2 Mediawiki - TemplateSandbox Extension 2 Mediawiki - CampaignEvents Extension 2 MediaWiki - ProofreadPage Extension 2 Mediawiki - Wikilove Extension 2 Mediawiki - Translate Extension 2 Mediawiki - Charts Extension 1 Mediawiki - UrlShortener Extension 1 Mediawiki - Thanks Extension 1 Mediawiki - UserPageViewTracker Extension 1 Wikipedia Android App 1 SyntaxHighlight GeSHi 1 CentralAuth 1 OAuth 1 UrlShortener 1 Mediawiki - RedirectManager Extension 1 MediaWiki CookieConsent extension 1 Mediawiki - Wikistories 1 Mediawiki - Skin:BlueSky 1 Mediawiki - Collection extension 1 MediaWiki MediaSearch extension 1 MediaWiki CommonsMetadata extension 1 MediaWiki Wikbase extension 1 MediaWiki Wikistories extension 1

Exploited only (KEV) →

CVE-2026-8857 High · 8.8 CWE-94 Jul 1, 2026

Full RCE using EasyTimeline Extension

A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58038 Medium · 6.1 CWE-79 Jul 1, 2026

Stored XSS through javascript URLs in SVGs generated by EasyTimeline

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58037 Medium · 6.1 CWE-79 Jul 1, 2026

Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58036 High · 7.5 CWE-200 Jul 1, 2026

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

CVE-2026-58033 Medium · 6.5 CWE-200 Jul 1, 2026

"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58032 Medium · 6.1 CWE-79 Jul 1, 2026

mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58030 Medium · 6.1 CWE-79 Jul 1, 2026

SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58029 Medium · 6.5 CWE-287 Jul 1, 2026

Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58028 Medium · 5.4 CWE-79 Jul 1, 2026

Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58027 Medium · 6.5 CWE-200 Jul 1, 2026

QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58026 Medium · 5.7 CWE-200 Jul 1, 2026

$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58025 Critical · 9.8 CWE-94 Jul 1, 2026

Remote Code Execution via Unsafe Deserialization in LogItem Import

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58024 Medium · 5.7 CWE-200 Jul 1, 2026

API identification of users on private wikis

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-13707 High · 7.6 CWE-384 Jul 1, 2026

Session fixation attacks on improperly configured OAuth 1.0a tools

Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-13706 High · 8.8 CWE-20 Jul 1, 2026

UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

CVE-2026-58035 Medium · 4.8 CWE-79 Jul 1, 2026

Stored XSS through a system message in the codex version of Special:Block

CVE-2026-58034 Medium · 4.8 CWE-79 Jul 1, 2026

Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.

CVE-2026-58031 Medium · 5.4 CWE-79 Jul 1, 2026

Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.

CVE-2026-58519 Medium · 5.4 CWE-79 Jul 1, 2026

Stored XSS through Cargo's map format

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.

CVE-2026-58518 Medium · 6.3 CWE-352 Jul 1, 2026

Cross-Site Request Forgery (CSRF) in Mediawiki

Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3.

CVE-2026-5266 Low · 2.3 CWE-200 May 11, 2026

Exposure of Sensitive Information in The Wikimedia Foundation Echo

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34095 Medium · 6.1 CWE-668 May 11, 2026

action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34094 Low · 3.8 CWE-668 May 11, 2026

Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34093 Medium · 5.3 CWE-200 May 11, 2026

Special:UserRights allows viewing user rights from private wiki

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34092 High · 7.5 CWE-200 May 11, 2026

Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.