The Wikimedia Foundation vulnerabilities
Published CVEs affecting The Wikimedia Foundation products: 181 record(s), with severity, exploitation and fixes.
MediaWiki 45Mediawiki - Cargo Extension 15CheckUser 9Mediawiki - WikiLambda Extension 7Mediawiki - CentralAuth Extension 5Mediawiki - Wikibase Extension 4Mediawiki - GrowthExperiments Extension 4MediaWiki - UploadWizard extension 3AbuseFilter 3Vector 2Timeline 2VisualEditor 2Mediawiki - CirrusSearch Extension 2MediaWiki PageForms extension 2Scribunto 2Mediawiki - PageTriage Extension 2OATHAuth 2Mediawiki - TemplateSandbox Extension 2Mediawiki - CampaignEvents Extension 2MediaWiki - ProofreadPage Extension 2Mediawiki - Wikilove Extension 2Mediawiki - Translate Extension 2Mediawiki - Charts Extension 1Mediawiki - UrlShortener Extension 1Mediawiki - Thanks Extension 1Mediawiki - UserPageViewTracker Extension 1Wikipedia Android App 1SyntaxHighlight GeSHi 1CentralAuth 1OAuth 1UrlShortener 1Mediawiki - RedirectManager Extension 1MediaWiki CookieConsent extension 1Mediawiki - Wikistories 1Mediawiki - Skin:BlueSky 1Mediawiki - Collection extension 1MediaWiki MediaSearch extension 1MediaWiki CommonsMetadata extension 1MediaWiki Wikbase extension 1MediaWiki Wikistories extension 1
CVE-2025-62662
Medium · 6.9
CWE-79 Oct 18, 2025
Stored XSS through system messages in AdvancedSearch
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.
CVE-2025-62665
Medium · 6.9
CWE-79 Oct 18, 2025
Stored XSS through system messages in Skin:BlueSky
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allows Stored XSS.This issue affects Mediawiki - Skin:BlueSky: from master before 1.39.
CVE-2025-62655
Low · 2.1
CWE-89 Oct 17, 2025
SQL injection in Cargo via Special:CargoExport
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44.
CVE-2025-62654
Low · 2.0
CWE-79 Oct 17, 2025
Stored XSS through system messages in QuizGame
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki QuizGame extension allows Stored XSS.This issue affects MediaWiki QuizGame extension: 1.39, 1.43, 1.44.
CVE-2025-62653
Low · 2.0
CWE-79 Oct 17, 2025
Stored XSS through system messages in PollNY
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PollNY extension allows Stored XSS.This issue affects MediaWiki PollNY extension: 1.39, 1.43, 1.44.
CVE-2025-62652
Medium · 5.9
CWE-79 Oct 17, 2025
Stored XSS in WebAuthn key name
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extension allows Stored XSS.This issue affects MediaWiki WebAuthn extension: 1.39, 1.43, 1.44.