CVE-2026-103585attacker-controlled javascript license URL via XSS Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki MediaSearch extension Published 09/30/2026 Severity Low CVE-2026-103584attacker-controlled javascript license URL via XSS Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki CommonsMetadata extension Published 09/30/2026 Severity Low CVE-2026-103440pagetriagelist discloses suppressed reviewer usernames Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki PageTriage extension Published 09/30/2026 Severity Low CVE-2026-103439Various rawParams() and escaped() updates to prevent XSS in Wikibase extension Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki Wikbase extension Published 09/30/2026 Severity Low CVE-2026-103438Various rawParams() and escaped() updates to prevent XSS in Wikistories extension Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki Wikistories extension Published 09/30/2026 Severity Low CVE-2026-103437ReadingLists imported metadata permits JavaScript URL XSS Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki ReadingLists extension Published 09/30/2026 Severity Low CVE-2026-103446WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments Exploitation status Not confirmed Fix Not confirmed Affected product M MediaWiki WikiLambda extension Published 09/30/2026 Severity High CVE-2026-103445Stored XSS through PageForms #autoedit redirect links Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki Page_Forms extension Published 09/30/2026 Severity Low CVE-2026-103444Stored XSS through system messages in WikiForum Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki WikiForum extension Published 09/30/2026 Severity Low CVE-2026-103443API permits session-seeded javascript URL XSS Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki Collection (Book) extension Published 09/30/2026 Severity Low CVE-2026-103442MergeAccount PHP object injection via session-key substitution Exploitation status Not confirmed Fix Not confirmed Affected product M MediaWiki CentralAuth extension Published 09/30/2026 Severity High CVE-2026-103441Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing Exploitation status Not confirmed Fix Not confirmed Affected product M MediaWiki Wikibase extension Published 09/30/2026 Severity High CVE-2026-103051Stored i18n XSSs in CentralNotice Exploitation status Not known exploited Fix Affected product M Mediawiki - CentralNotice extension Published 09/29/2026 Severity Medium CVE-2026-103050Stored i18n XSS in MassMessage Exploitation status Not known exploited Fix Affected product M Mediawiki - MassMessage extension Published 09/29/2026 Severity Medium CVE-2026-103049XSS in Cargo's Special:CargoQuery page due to unsanitized table headers Exploitation status Not known exploited Fix Affected product M Mediawiki - Cargo extension Published 09/29/2026 Severity Medium CVE-2026-103048Open Redirect in Special:Book Exploitation status Not known exploited Fix Affected product M Mediawiki - Collection extension Published 09/29/2026 Severity Medium CVE-2026-103047XSS through i18n message in CentralAuth Exploitation status Not known exploited Fix Affected product M Mediawiki - CentralAuth extension Published 09/29/2026 Severity Medium CVE-2026-103045XSS in Refreshed skin Exploitation status Not known exploited Fix Affected product M Mediawiki - Refreshed skin Published 09/29/2026 Severity Medium CVE-2026-103044EasyTimeline should not serve image maps as application/xml Exploitation status Not known exploited Fix Affected product M Mediawiki - EasyTimeline extension Published 09/29/2026 Severity Critical CVE-2026-103046WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML Exploitation status Not known exploited Fix Affected product M Mediawiki - WikiLambda Extension Published 09/29/2026 Severity Medium CVE-2026-96879"Checked by" label in page history should not be shown if the underlying review log entry is suppressed" Exploitation status Not known exploited Fix Affected product M Mediawiki - FlaggedRevs extension Published 09/25/2026 Severity Medium CVE-2026-96878Cargo Exhibit field alias allows stored XSS Exploitation status Not known exploited Fix Affected product M Mediawiki - Cargo extension Published 09/25/2026 Severity Medium CVE-2026-96877Reflected XSS through Cargo Drilldown full-text search Exploitation status Not known exploited Fix Affected product M Mediawiki - Cargo extension Published 09/25/2026 Severity Medium CVE-2026-96876Anonymous reflected XSS in CargoExport invalid-alias errors Exploitation status Not known exploited Fix Affected product M Mediawiki - Cargo extension Published 09/25/2026 Severity Medium CVE-2026-96875Reflected XSS in Cargo Drilldown hierarchy filters Exploitation status Not known exploited Fix Affected product M Mediawiki - Cargo extension Published 09/25/2026 Severity Medium CVE-2026-100237Stored i18n XSS in the Flow integration of Thanks Exploitation status Not known exploited Fix Affected product M Mediawiki - Thanks Extension Published 09/25/2026 Severity Medium CVE-2026-96874Stored XSS in Cargo Drilldown tab names Exploitation status Not known exploited Fix Affected product M Mediawiki - Cargo extension Published 09/25/2026 Severity Low CVE-2026-96873Reflected XSS in CirrusSearch debug explain output Exploitation status Not known exploited Fix Affected product M Mediawiki - CirrusSearch Extension Published 09/24/2026 Severity Medium CVE-2026-96872WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions Exploitation status Not known exploited Fix Affected product M Mediawiki - WikiLambda Extension Published 09/23/2026 Severity Low CVE-2026-14363Cargo Extension: SQLi in Special:Drilldown Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo extension Published 07/01/2026 Severity Medium CVE-2026-14358Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title Exploitation status Not known exploited Fix Affected product M Mediawiki - Charts Extension Published 07/01/2026 Severity Medium CVE-2026-58517Blocked users can create and edit WikiLambda objects Exploitation status Not known exploited Fix Affected product M Mediawiki - WikiLambda Extension Published 07/01/2026 Severity Medium CVE-2026-58521SQLi in Cargo extension via year range filter Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo extension Published 07/01/2026 Severity Medium CVE-2026-58520UrlShortener defaults to ineffective validation open to third-party redirects Exploitation status Not known exploited Fix Affected product M Mediawiki - UrlShortener Extension Published 07/01/2026 Severity Medium CVE-2026-58519Stored XSS through Cargo's map format Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo extension Published 07/01/2026 Severity Medium CVE-2026-58518Exploitation status Public exploit Fix Affected product M Mediawiki - RedirectManager Extension Published 07/01/2026 Severity Medium CVE-2026-39936Stored XSS in Score due to usage of non-reserved data attributes Exploitation status Public exploit Fix Affected product M Mediawiki - Score Extension Published 04/07/2026 Severity Medium CVE-2026-39935XSS-via-i18n in localised wiki names Exploitation status Not known exploited Fix Affected product M Mediawiki - CampaignEvents Extension Published 04/07/2026 Severity Medium CVE-2026-39934Growth Experiments ReassignMenteesJob runs as an infinite loop Exploitation status Not known exploited Fix Affected product M Mediawiki - GrowthExperiments Extension Published 04/07/2026 Severity Medium CVE-2026-39933Multiple XSS vulnerabilities in GlobalWatchlist Exploitation status Not known exploited Fix Affected product M Mediawiki - GlobalWatchlist Extension Published 04/07/2026 Severity Medium CVE-2026-39937Global vanishing does not completely remove user email Exploitation status Not known exploited Fix Affected product M Mediawiki - CentralAuth extension Published 04/07/2026 Severity High CVE-2026-22711Stored XSS through system messages in WikiLove Exploitation status Public exploit Fix Affected product M Mediawiki - WikiLove Extension Published 04/07/2026 Severity Medium CVE-2025-11175DiscussionTools should use better regex Exploitation status Not known exploited Fix Not confirmed Affected product M Mediawiki - DiscussionTools Extension Published 01/30/2026 Severity High CVE-2026-22712ApprovedRevs allows bypassing the inline CSS sanitizer Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki - ApprovedRevs Extension Published 01/09/2026 Severity Low CVE-2026-22713Stored XSS through edit summaries in GrowthExperiments Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki - GrowthExperiments Extension Published 01/09/2026 Severity Low CVE-2026-22714i18n XSS, DoS and config SQLI in Monaco Exploitation status Not known exploited Fix Not confirmed Affected product M Mediawiki - Monaco Skin Published 01/08/2026 Severity Low CVE-2026-22710Stored XSS through autocomment system messages in Wikibase Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki - Wikibase Extension Published 01/08/2026 Severity Low CVE-2025-62659The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors Exploitation status Not known exploited Fix Affected product M MediaWiki CookieConsent extension Published 10/22/2025 Severity Low CVE-2025-62661Do permission checking when getting counts of global and local edits, new articles and thanks Exploitation status Not known exploited Fix Affected product M Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension Published 10/21/2025 Severity Medium CVE-2025-12004The compare API module breaks Extension:Lockdown Exploitation status Public exploit Fix Affected product M Mediawiki - Lockdown Extension Published 10/21/2025 Severity Critical CVE-2025-62701Stored XSS through system messages Exploitation status Public exploit Fix Affected product M Mediawiki - Wikistories Published 10/21/2025 Severity Medium CVE-2025-62702Stored XSS through system messages Exploitation status Public exploit Fix Affected product M Mediawiki - PageTriage Extension Published 10/21/2025 Severity Medium CVE-2025-62694Stored XSS through a system message Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki - WikiLove Extension Published 10/21/2025 Severity Medium CVE-2025-62695Stored XSS through system messages Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki - WikiLambda Extension Published 10/21/2025 Severity Medium CVE-2025-62696Multiple critical security issues in Springboard Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki Foundation - Springboard Extension Published 10/21/2025 Severity Medium CVE-2025-62699Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool Exploitation status Not known exploited Fix Affected product M Mediawiki - Translate Extension Published 10/21/2025 Severity Medium CVE-2025-62658SQL injection in WatchAnalytics through Special:ClearPendingReviews Exploitation status Public exploit Fix Not confirmed Affected product M MediaWiki WatchAnalytics extension Published 10/20/2025 Severity High CVE-2025-62657Stored XSS through system messages in PageForms Exploitation status Public exploit Fix Not confirmed Affected product M MediaWiki PageForms extension Published 10/20/2025 Severity Medium CVE-2025-62656GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki GlobalBlocking extension Published 10/20/2025 Severity Medium CVE-2025-62697Improperly sanitized style parameter in LanguageSelector Exploitation status Not known exploited Fix Affected product M Mediawiki - LanguageSelector Extension Published 10/20/2025 Severity High CVE-2025-62698Stored XSS through system messages in ExternalGuidance Exploitation status Not known exploited Fix Affected product M Mediawiki - ExternalGuidance Published 10/20/2025 Severity Medium CVE-2025-62700Stored XSS through a system message in MultiBoilerplate Exploitation status Not known exploited Fix Affected product M Mediawiki - MultiBoilerplate Extensionmaste Published 10/20/2025 Severity Medium CVE-2025-62693Stored XSS through system messages in LastModified Exploitation status Not known exploited Fix Affected product M Mediawiki - LastModified Extension Published 10/20/2025 Severity Medium CVE-2025-11937Stored XSS through a system message in SecurePoll Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki - SecurePoll Extension Published 10/18/2025 Severity Medium CVE-2025-62666DoS vector through the cirrusbuilddoc query API Exploitation status Not known exploited Fix Affected product M Mediawiki - CirrusSearch Extension Published 10/18/2025 Severity Medium CVE-2025-62667Stored XSS through article extracts in GrowthExperiments Exploitation status Not known exploited Fix Affected product M Mediawiki - GrowthExperiments Extension Published 10/18/2025 Severity Medium CVE-2025-62668Insufficient permission checks in action=growthsetmentor Exploitation status Not known exploited Fix Affected product M Mediawiki - GrowthExperiments Extension Published 10/18/2025 Severity Medium CVE-2025-62669UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks Exploitation status Public exploit Fix Affected product M Mediawiki - CentralAuth extension Published 10/18/2025 Severity Medium CVE-2025-62670Stored XSS through a system message in FlexDiagrams Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki - FlexDiagrams Extension Published 10/18/2025 Severity Medium CVE-2025-62671Stored XSS through wikitext in Cargo Exploitation status Public exploit Fix Not confirmed Affected product M Mediawiki - Cargo extension Published 10/18/2025 Severity Medium CVE-2025-62662Stored XSS through system messages in AdvancedSearch Exploitation status Public exploit Fix Affected product M Mediawiki - AdvancedSearch Extension Published 10/18/2025 Severity Medium CVE-2025-62663Stored XSS through a system message in UploadWizard Exploitation status Public exploit Fix Affected product M Mediawiki - UploadWizard Extension Published 10/18/2025 Severity Medium CVE-2025-62664Stored XSS through a system message in ImageRating Exploitation status Public exploit Fix Affected product M Mediawiki - ImageRating Extension Published 10/18/2025 Severity Medium CVE-2025-62655SQL injection in Cargo via Special:CargoExport Exploitation status Public exploit Fix Not confirmed Affected product M MediaWiki Cargo extension Published 10/17/2025 Severity Low CVE-2025-62654Stored XSS through system messages in QuizGame Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki QuizGame extension Published 10/17/2025 Severity Low CVE-2025-62653Stored XSS through system messages in PollNY Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki PollNY extension Published 10/17/2025 Severity Low CVE-2025-62652Stored XSS in WebAuthn key name Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki WebAuthn extension Published 10/17/2025 Severity Medium CVE-2025-32077XSSes in Extension:SimpleCalendar Exploitation status Not known exploited Fix Affected product M Mediawiki - Extension:SimpleCalendar Published 04/11/2025 Severity Medium CVE-2025-32078XSSes and potential RCE in Special:VersionCompare Exploitation status Not known exploited Fix Affected product M Mediawiki - Version Compare Extension Published 04/11/2025 Severity Medium CVE-2025-32079Saving the right content to MediaWiki:GrowthMentors.json can take down the site Exploitation status Not known exploited Fix Affected product M Mediawiki - GrowthExperiments Published 04/11/2025 Severity Medium CVE-2025-32080Cross-origin data leak in mobilefrontend via lazy load images Exploitation status Not known exploited Fix Affected product M Mediawiki - Mobile Frontend Extension Published 04/11/2025 Severity Medium CVE-2025-32076Evil regex used to process user-provided data in VisualData Exploitation status Not known exploited Fix Affected product M Mediawiki - Visual Data Extension Published 04/11/2025 Severity Medium CVE-2025-32072HTML injection in feed output from i18n message Exploitation status Not known exploited Fix Affected product M Mediawiki Core - Feed Utils Published 04/11/2025 Severity Medium CVE-2025-32073System message XSS in HTMLTags Exploitation status Not known exploited Fix Affected product M Mediawiki - HTML Tags Published 04/11/2025 Severity Medium CVE-2025-32074XSSes in Extension:ConfirmAccount Exploitation status Not known exploited Fix Affected product M Mediawiki - Confirm Account Extension Published 04/11/2025 Severity Medium CVE-2025-32075IP and user agent leaks in Extension:Tabs Exploitation status Public exploit Fix Affected product M Mediawiki - Tabs Extension Published 04/11/2025 Severity Medium CVE-2025-32067i18n XSS vulnerability in message growthexperiments Exploitation status Not known exploited Fix Affected product M Mediawiki - Growth Experiments Extension Published 04/11/2025 Severity Medium CVE-2025-32068Revoking authorization of OAuth2 consumer does not invalidate refresh tokens Exploitation status Not known exploited Fix Affected product M Mediawiki - OAuth Extension Published 04/11/2025 Severity Medium CVE-2025-32069Wikitext stored XSS on filepages due to dangerous WBMI serialization Exploitation status Not known exploited Fix Affected product M Mediawiki - Wikibase Media Info Extension Published 04/11/2025 Severity Medium CVE-2025-32070XSSes in AJAXPoll Exploitation status Not known exploited Fix Affected product M Mediawiki - AJAX Poll Extension Published 04/11/2025 Severity Medium CVE-2025-32071Wikibase CommonsInlineImageFormatter: i18n XSS Exploitation status Public exploit Fix Affected product M Mediawiki - Wikidata Extension Published 04/11/2025 Severity Medium CVE-2024-47841Path traversal when loading stylesheets Exploitation status Public exploit Fix Affected product M Mediawiki - CSS Extension Published 10/05/2024 Severity Medium CVE-2024-47840Stored XSS through sidebar in Apex skin Exploitation status Public exploit Fix Affected product M Mediawiki - Apex skin Published 10/05/2024 Severity Medium CVE-2024-47847Various XSSes found in Cargo Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo Published 10/05/2024 Severity Medium CVE-2024-47846Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo Published 10/05/2024 Severity Medium CVE-2024-47849Backticks can allow the usage of not-allowed SQL functions Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo Published 10/05/2024 Severity High CVE-2024-47845CSS sanitizer used incorrectly, and is easily bypassed Exploitation status Public exploit Fix Affected product M Mediawiki - CSS Extension Published 10/05/2024 Severity Medium CVE-2024-47848User can review/unreview articles while blocked Exploitation status Not known exploited Fix Affected product M Mediawiki - PageTriage Published 10/04/2024 Severity Medium 
%20extension.svg){kind=icon}
