CVE-2026-58025Remote Code Execution via Unsafe Deserialization in LogItem Import Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Medium CVE-2026-58029Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Medium CVE-2026-58028Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Informational CVE-2026-58026$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Informational CVE-2026-8857Full RCE using EasyTimeline Extension Exploitation status Not known exploited Fix Affected product T timeline Published 07/01/2026 Severity Informational CVE-2026-58038Stored XSS through javascript URLs in SVGs generated by EasyTimeline Exploitation status Not known exploited Fix Affected product T timeline Published 07/01/2026 Severity Informational CVE-2026-58027QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI Exploitation status Not known exploited Fix Affected product A AbuseFilter Published 07/01/2026 Severity Medium CVE-2026-58030SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute Exploitation status Not known exploited Fix Affected product S SyntaxHighlight_GeSHi Published 07/01/2026 Severity Medium CVE-2026-58032mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Medium CVE-2026-58033"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Medium CVE-2026-58037Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Informational CVE-2026-58036Users API leaks whether privileged users have their user groups disabled for lack of 2FA Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Low CVE-2026-58024API identification of users on private wikis Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Medium CVE-2026-13707Session fixation attacks on improperly configured OAuth 1.0a tools Exploitation status Not known exploited Fix Affected product O OAuth Published 07/01/2026 Severity Informational CVE-2026-13706UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG Exploitation status Not known exploited Fix Affected product U UrlShortener Published 07/01/2026 Severity Informational CVE-2026-58031Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Informational CVE-2026-58034Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts Exploitation status Not known exploited Fix Affected product C CheckUser Published 07/01/2026 Severity Informational CVE-2026-58035Stored XSS through a system message in the codex version of Special:Block Exploitation status Not known exploited Fix Affected product M MediaWiki Published 07/01/2026 Severity Informational CVE-2026-5266Exploitation status Not known exploited Fix Affected product E Echo Published 05/11/2026 Severity Low CVE-2026-34095action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request Exploitation status Not known exploited Fix Affected product M MediaWiki Published 05/11/2026 Severity Informational CVE-2026-34094Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix Exploitation status Not known exploited Fix Affected product M MediaWiki Published 05/11/2026 Severity Low CVE-2026-34093Special:UserRights allows viewing user rights from private wiki Exploitation status Not known exploited Fix Affected product M MediaWiki Published 05/11/2026 Severity Low CVE-2026-34092Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP Exploitation status Not known exploited Fix Affected product M MediaWiki Published 05/11/2026 Severity Low CVE-2026-34091User localization leaked by AbuseFilter + EventStream Exploitation status Not known exploited Fix Affected product M MediaWiki Published 05/11/2026 Severity Medium CVE-2026-34090Suggested investigations: Handle suppressed usernames Exploitation status Not known exploited Fix Affected product C CheckUser Published 05/11/2026 Severity Medium CVE-2026-34089Memory leak in Scribunto causes runJobs.php to run out of memory Exploitation status Not known exploited Fix Affected product S Scribunto Published 05/11/2026 Severity Low CVE-2026-34088RecentChanges entries expose suppressed content via generated log page html Exploitation status Not known exploited Fix Affected product M MediaWiki Published 05/11/2026 Severity Low CVE-2026-34087Users API leaks whether privileged users have their user groups disabled for lack of 2FA Exploitation status Not known exploited Fix Affected product O OATHAuth Published 05/11/2026 Severity Medium CVE-2026-34086AbuseFilter misuses ::userCanBitfield, exposing access-controlled information Exploitation status Not known exploited Fix Affected product A AbuseFilter Published 05/11/2026 Severity Low CVE-2026-39837Stored XSS through the dynamic table format in Cargo Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo Extension Published 04/07/2026 Severity Medium CVE-2026-39841Stored XSS through list fields on Cargo's page values and Special:CargoTables Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo Extension Published 04/07/2026 Severity Medium CVE-2026-39840CSS injection in multiple Cargo display formats Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo Extension Published 04/07/2026 Severity Medium CVE-2026-39839Stored XSS through URLs in Cargo's map format Exploitation status Public exploit Fix Affected product M Mediawiki - Cargo Extension Published 04/07/2026 Severity Medium CVE-2026-39838ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS Exploitation status Public exploit Fix Affected product M MediaWiki - ProofreadPage Extension Published 04/07/2026 Severity Medium CVE-2026-5762ReportIncident DiscussionTools integration causes slow requests Exploitation status Public exploit Fix Affected product M MediaWiki - ReportIncident Extension Published 04/07/2026 Severity Medium CVE-2025-67481mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-67482Lua segfault in unpack() Exploitation status Not known exploited Fix Affected product S Scribunto Published 02/03/2026 Severity Low CVE-2025-67483Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-67484Action API xslt option allows JavaScript execution by administrators who are not interface administrators Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-67480list=allrevisions can be used to bypass Extension:Lockdown Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-67475Stored XSS through edit summaries in MW Core Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-67476Importing leaks IP address of importer via EventStreams Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Low CVE-2025-67477Stored XSS through a system message in Special:ApiSandbox Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-67478Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn" Exploitation status Not known exploited Fix Affected product C CheckUser Published 02/03/2026 Severity Informational CVE-2025-67479Magic word replacement in legacy parser allows using reserved data attributes through wikitext Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-61654UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanks Exploitation status Not known exploited Fix Affected product T Thanks Published 02/03/2026 Severity Informational CVE-2025-61655Stored XSS through system messages in VisualEditor Exploitation status Not known exploited Fix Affected product V VisualEditor Published 02/03/2026 Severity Informational CVE-2025-61656XSS when pasting into VE Exploitation status Not known exploited Fix Affected product V VisualEditor Published 02/03/2026 Severity Informational CVE-2025-61657Exploitation status Not known exploited Fix Affected product V Vector Published 02/03/2026 Severity Informational CVE-2025-61658Special:GlobalContributions shows edits on wikis the viewer doesn't have access to Exploitation status Not known exploited Fix Affected product C CheckUser Published 02/03/2026 Severity Low CVE-2025-61653Extension:TextExtracts does not check for authorizeRead when returning extracts Exploitation status Not known exploited Fix Affected product T TextExtracts Published 02/03/2026 Severity Low CVE-2025-61652Action API discussiontoolspageinfo does not check for authorizeRead for the page Exploitation status Not known exploited Fix Affected product D DiscussionTools Published 02/03/2026 Severity Low CVE-2025-61651i18n XSS through Special:CheckUser CheckUser helper Exploitation status Not known exploited Fix Affected product C CheckUser Published 02/03/2026 Severity Informational CVE-2025-11173Reauth for enabling 2FA can be bypassed by submitting a form Exploitation status Not known exploited Fix Affected product O OATHAuth Published 02/03/2026 Severity Informational CVE-2025-11261Stored i18n XSS exposed by security patch for T402077 Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-61648Stored XSS through system messages in CheckUser Exploitation status Not known exploited Fix Affected product C CheckUser Published 02/03/2026 Severity Informational CVE-2025-61649UserInfoCard: Check that performing user has permission to view log entries for number of past blocks Exploitation status Not known exploited Fix Not confirmed Affected product C CheckUser Published 02/03/2026 Severity Low CVE-2025-61650UserInfoCard is vulnerable to message key stored XSS Exploitation status Not known exploited Fix Affected product C CheckUser Published 02/03/2026 Severity Low CVE-2025-61645CodexTablePager has i18n XSS Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Informational CVE-2025-61646Watchlist group mode reveals authors of edits with hidden authorship Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/03/2026 Severity Low CVE-2025-61647UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rights Exploitation status Not known exploited Fix Not confirmed Affected product C CheckUser Published 02/03/2026 Severity Low CVE-2025-61644i18n XSS through Special:Watchlist Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-61637Stored XSS through system messages in MW Core Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-61638Sanitizer::validateAttributes data-XSS Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-61639Suppressed blocked IP is visible in Special:BlockList, RC, and other places Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Low CVE-2025-61640Stored XSS through system messages in Special:RecentChangesLinked (MW Core) Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-61641API list=allpages with maxsize is making really slow queries Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Low CVE-2025-61642Stored XSS through system messages provided to CodexHtmlForms Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-61643EventStreams publishes suppressed recent change entries that are suppressed from their creation Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Low CVE-2025-61634HTML rest endpoint needs PoolCounter and proper parser cache check Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-61635Add rate limiting to ApiFancyCaptchaReload Exploitation status Not known exploited Fix Not confirmed Affected product C ConfirmEdit Published 02/02/2026 Severity Informational CVE-2025-61636Codex Special:Block vulnerable to message key XSS Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-6589With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki Published 02/02/2026 Severity Low CVE-2025-6590Complete content leak of private wikis due to PasswordReset Wikitext injection in error message Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Medium CVE-2025-6591HTML injection in API action=feedcontributions output from i18n message Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-6592Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog Exploitation status Not known exploited Fix Affected product A AbuseFilter Published 02/02/2026 Severity Low CVE-2025-6593"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Low CVE-2025-6594XSS in Special:ApiSandbox Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-6595Exploitation status Not known exploited Fix Affected product M MultimediaViewer Published 02/02/2026 Severity Informational CVE-2025-6596Vector inserts portlet labels as HTML, allowing for stored XSS through system messages Exploitation status Not known exploited Fix Affected product V Vector Published 02/02/2026 Severity Informational CVE-2025-6597MediaWiki should not consider autocreation as login for the purposes of security reauthentication Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Informational CVE-2025-6927Autoblocks from global account suppressions are publicly visible Exploitation status Not known exploited Fix Affected product M MediaWiki Published 02/02/2026 Severity Low CVE-2026-0817CampaignEvents API missing authorization exposes meeting and chat URLs Exploitation status Not known exploited Fix Not confirmed Affected product M Mediawiki - CampaignEvents Extension Published 01/09/2026 Severity Medium CVE-2026-0671Multiple stored i18n/message-key XSSes in UploadWizard Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki - UploadWizard extension Published 01/08/2026 Severity Medium CVE-2026-0670Stored XSS through a system message and a user-provided parameter in ProofreadPage Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki - ProofreadPage Extension Published 01/07/2026 Severity Medium CVE-2026-0669Path Traversal vulnerability in CSS extension on certain web servers Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki - CSS extension Published 01/07/2026 Severity High CVE-2026-0668VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user input Exploitation status Not known exploited Fix Not confirmed Affected product M MediaWiki - VisualData Extension Published 01/07/2026 Severity Medium CVE-2025-52738WordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W Wikipedia Preview Published 10/22/2025 Severity Medium CVE-2025-62665Stored XSS through system messages in Skin:BlueSky Exploitation status Public exploit Fix Affected product M Mediawiki - Skin:BlueSky Published 10/18/2025 Severity Medium CVE-2025-7363TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser function Exploitation status Public exploit Fix Affected product M Mediawiki - TitleIcon extension Published 07/08/2025 Severity Medium CVE-2025-7362MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message Exploitation status Public exploit Fix Affected product M Mediawiki - MsUpload extension Published 07/08/2025 Severity Medium CVE-2025-53479CheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized message Exploitation status Public exploit Fix Affected product M Mediawiki - CheckUser extension Published 07/08/2025 Severity Medium CVE-2025-53480CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages Exploitation status Not known exploited Fix Affected product M Mediawiki - CheckUser extension Published 07/08/2025 Severity Medium CVE-2025-53496Stored XSS in MediaSearch Exploitation status Not known exploited Fix Affected product M Mediawiki - MediaSearch Extension Published 07/07/2025 Severity Medium CVE-2025-53488Stored XSS in WikiHiero Exploitation status Public exploit Fix Affected product M Mediawiki - WikiHiero Extension Published 07/07/2025 Severity Medium CVE-2025-53498Lack of Audit Logging in AbuseFilter Exploitation status Public exploit Fix Affected product M Mediawiki - AbuseFilter Extension Published 07/07/2025 Severity Medium CVE-2025-53499Unauthorized Inspection of Protected Variables in AbuseFilter Exploitation status Not known exploited Fix Affected product M Mediawiki - AbuseFilter Extension Published 07/07/2025 Severity Critical CVE-2025-53495Unauthorized Disclosure of IP Reputation in AbuseFilter Exploitation status Not known exploited Fix Affected product M Mediawiki - AbuseFilter Extension Published 07/07/2025 Severity Critical CVE-2025-53478CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messages Exploitation status Not known exploited Fix Affected product M Mediawiki - CheckUser extension Published 07/07/2025 Severity Medium CVE-2025-53497Stored XSS in RelatedArticles Exploitation status Public exploit Fix Affected product M Mediawiki - RelatedArticles Extension Published 07/07/2025 Severity Medium 
