# cve.now: THE Wikimedia Foundation

The newest entries naming THE Wikimedia Foundation as an affected vendor (up to 200), of 98 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103585](https://cve.now/CVE-2026-103585.md): attacker-controlled javascript license URL via XSS (CVSS 1.2)
- [CVE-2026-103584](https://cve.now/CVE-2026-103584.md): attacker-controlled javascript license URL via XSS (CVSS 1.1)
- [CVE-2026-103440](https://cve.now/CVE-2026-103440.md): pagetriagelist discloses suppressed reviewer usernames (CVSS 1.2)
- [CVE-2026-103439](https://cve.now/CVE-2026-103439.md): Various rawParams() and escaped() updates to prevent XSS in Wikibase extension (CVSS 0.3)
- [CVE-2026-103438](https://cve.now/CVE-2026-103438.md): Various rawParams() and escaped() updates to prevent XSS in Wikistories extension (CVSS 0.3)
- [CVE-2026-103437](https://cve.now/CVE-2026-103437.md): ReadingLists imported metadata permits JavaScript URL XSS (CVSS 1.1)
- [CVE-2026-103446](https://cve.now/CVE-2026-103446.md): WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments (CVSS 7.4)
- [CVE-2026-103445](https://cve.now/CVE-2026-103445.md): Stored XSS through PageForms #autoedit redirect links (CVSS 1.2)
- [CVE-2026-103444](https://cve.now/CVE-2026-103444.md): Stored XSS through system messages in WikiForum (CVSS 1.1)
- [CVE-2026-103443](https://cve.now/CVE-2026-103443.md): API permits session-seeded javascript URL XSS (CVSS 1.1)
- [CVE-2026-103442](https://cve.now/CVE-2026-103442.md): MergeAccount PHP object injection via session-key substitution (CVSS 7.2)
- [CVE-2026-103441](https://cve.now/CVE-2026-103441.md): Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing (CVSS 7.2)
- [CVE-2026-103051](https://cve.now/CVE-2026-103051.md): Stored i18n XSSs in CentralNotice (CVSS 6.1)
- [CVE-2026-103050](https://cve.now/CVE-2026-103050.md): Stored i18n XSS in MassMessage (CVSS 6.1)
- [CVE-2026-103049](https://cve.now/CVE-2026-103049.md): XSS in Cargo's Special:CargoQuery page due to unsanitized table headers (CVSS 6.1)
- [CVE-2026-103048](https://cve.now/CVE-2026-103048.md): Open Redirect in Special:Book (CVSS 6.1)
- [CVE-2026-103047](https://cve.now/CVE-2026-103047.md): XSS through i18n message in CentralAuth (CVSS 6.1)
- [CVE-2026-103045](https://cve.now/CVE-2026-103045.md): XSS in Refreshed skin (CVSS 6.1)
- [CVE-2026-103044](https://cve.now/CVE-2026-103044.md): EasyTimeline should not serve image maps as application/xml (CVSS 9.8)
- [CVE-2026-103046](https://cve.now/CVE-2026-103046.md): WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML (CVSS 6.1)
- [CVE-2026-96879](https://cve.now/CVE-2026-96879.md): "Checked by" label in page history should not be shown if the underlying review log entry is suppressed" (CVSS 6.9)
- [CVE-2026-96878](https://cve.now/CVE-2026-96878.md): Cargo Exhibit field alias allows stored XSS (CVSS 6.9)
- [CVE-2026-96877](https://cve.now/CVE-2026-96877.md): Reflected XSS through Cargo Drilldown full-text search (CVSS 6.9)
- [CVE-2026-96876](https://cve.now/CVE-2026-96876.md): Anonymous reflected XSS in CargoExport invalid-alias errors (CVSS 6.9)
- [CVE-2026-96875](https://cve.now/CVE-2026-96875.md): Reflected XSS in Cargo Drilldown hierarchy filters (CVSS 6.9)
- [CVE-2026-100237](https://cve.now/CVE-2026-100237.md): Stored i18n XSS in the Flow integration of Thanks (CVSS 6.1)
- [CVE-2026-96874](https://cve.now/CVE-2026-96874.md): Stored XSS in Cargo Drilldown tab names (CVSS 2.3)
- [CVE-2026-96873](https://cve.now/CVE-2026-96873.md): Reflected XSS in CirrusSearch debug explain output (CVSS 5.5)
- [CVE-2026-96872](https://cve.now/CVE-2026-96872.md): WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions (CVSS 2.9)
- [CVE-2026-14363](https://cve.now/CVE-2026-14363.md): Cargo Extension: SQLi in Special:Drilldown (CVSS 6.9)
- [CVE-2026-14358](https://cve.now/CVE-2026-14358.md): Stored XSS in Wikimedia Chart pie tooltip via Data:\*.tab field title (CVSS 6.9)
- [CVE-2026-58517](https://cve.now/CVE-2026-58517.md): Blocked users can create and edit WikiLambda objects (CVSS 6.9)
- [CVE-2026-58521](https://cve.now/CVE-2026-58521.md): SQLi in Cargo extension via year range filter (CVSS 6.9)
- [CVE-2026-58520](https://cve.now/CVE-2026-58520.md): UrlShortener defaults to ineffective validation open to third-party redirects (CVSS 6.9)
- [CVE-2026-58519](https://cve.now/CVE-2026-58519.md): Stored XSS through Cargo's map format (CVSS 6.9)
- [CVE-2026-58518](https://cve.now/CVE-2026-58518.md): Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request (CVSS 6.9)
- [CVE-2026-39936](https://cve.now/CVE-2026-39936.md): Stored XSS in Score due to usage of non-reserved data attributes (CVSS 6.9)
- [CVE-2026-39935](https://cve.now/CVE-2026-39935.md): XSS-via-i18n in localised wiki names (CVSS 6.9)
- [CVE-2026-39934](https://cve.now/CVE-2026-39934.md): Growth Experiments ReassignMenteesJob runs as an infinite loop (CVSS 6.9)
- [CVE-2026-39933](https://cve.now/CVE-2026-39933.md): Multiple XSS vulnerabilities in GlobalWatchlist (CVSS 6.9)
- [CVE-2026-39937](https://cve.now/CVE-2026-39937.md): Global vanishing does not completely remove user email (CVSS 8.8)
- [CVE-2026-22711](https://cve.now/CVE-2026-22711.md): Stored XSS through system messages in WikiLove (CVSS 6.9)
- [CVE-2025-11175](https://cve.now/CVE-2025-11175.md): DiscussionTools should use better regex (CVSS 8.8)
- [CVE-2026-22712](https://cve.now/CVE-2026-22712.md): ApprovedRevs allows bypassing the inline CSS sanitizer (CVSS 2.3)
- [CVE-2026-22713](https://cve.now/CVE-2026-22713.md): Stored XSS through edit summaries in GrowthExperiments (CVSS 2.3)
- [CVE-2026-22714](https://cve.now/CVE-2026-22714.md): i18n XSS, DoS and config SQLI in Monaco (CVSS 2.3)
- [CVE-2026-22710](https://cve.now/CVE-2026-22710.md): Stored XSS through autocomment system messages in Wikibase (CVSS 2.3)
- [CVE-2025-62659](https://cve.now/CVE-2025-62659.md): The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors (CVSS 2.1)
- [CVE-2025-62661](https://cve.now/CVE-2025-62661.md): Do permission checking when getting counts of global and local edits, new articles and thanks (CVSS 6.9)
- [CVE-2025-12004](https://cve.now/CVE-2025-12004.md): The compare API module breaks Extension:Lockdown (CVSS 10.0)
- [CVE-2025-62701](https://cve.now/CVE-2025-62701.md): Stored XSS through system messages (CVSS 6.9)
- [CVE-2025-62702](https://cve.now/CVE-2025-62702.md): Stored XSS through system messages (CVSS 6.9)
- [CVE-2025-62694](https://cve.now/CVE-2025-62694.md): Stored XSS through a system message (CVSS 6.9)
- [CVE-2025-62695](https://cve.now/CVE-2025-62695.md): Stored XSS through system messages (CVSS 6.9)
- [CVE-2025-62696](https://cve.now/CVE-2025-62696.md): Multiple critical security issues in Springboard (CVSS 6.9)
- [CVE-2025-62699](https://cve.now/CVE-2025-62699.md): Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool (CVSS 6.9)
- [CVE-2025-62658](https://cve.now/CVE-2025-62658.md): SQL injection in WatchAnalytics through Special:ClearPendingReviews (CVSS 7.5)
- [CVE-2025-62657](https://cve.now/CVE-2025-62657.md): Stored XSS through system messages in PageForms (CVSS 5.8)
- [CVE-2025-62656](https://cve.now/CVE-2025-62656.md): GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS (CVSS 5.8)
- [CVE-2025-62697](https://cve.now/CVE-2025-62697.md): Improperly sanitized style parameter in LanguageSelector (CVSS 8.8)
- [CVE-2025-62698](https://cve.now/CVE-2025-62698.md): Stored XSS through system messages in ExternalGuidance (CVSS 6.9)
- [CVE-2025-62700](https://cve.now/CVE-2025-62700.md): Stored XSS through a system message in MultiBoilerplate (CVSS 6.9)
- [CVE-2025-62693](https://cve.now/CVE-2025-62693.md): Stored XSS through system messages in LastModified (CVSS 6.9)
- [CVE-2025-11937](https://cve.now/CVE-2025-11937.md): Stored XSS through a system message in SecurePoll (CVSS 6.9)
- [CVE-2025-62666](https://cve.now/CVE-2025-62666.md): DoS vector through the cirrusbuilddoc query API (CVSS 6.9)
- [CVE-2025-62667](https://cve.now/CVE-2025-62667.md): Stored XSS through article extracts in GrowthExperiments (CVSS 6.9)
- [CVE-2025-62668](https://cve.now/CVE-2025-62668.md): Insufficient permission checks in action=growthsetmentor (CVSS 6.9)
- [CVE-2025-62669](https://cve.now/CVE-2025-62669.md): UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks (CVSS 6.9)
- [CVE-2025-62670](https://cve.now/CVE-2025-62670.md): Stored XSS through a system message in FlexDiagrams (CVSS 6.9)
- [CVE-2025-62671](https://cve.now/CVE-2025-62671.md): Stored XSS through wikitext in Cargo (CVSS 6.9)
- [CVE-2025-62662](https://cve.now/CVE-2025-62662.md): Stored XSS through system messages in AdvancedSearch (CVSS 6.9)
- [CVE-2025-62663](https://cve.now/CVE-2025-62663.md): Stored XSS through a system message in UploadWizard (CVSS 6.9)
- [CVE-2025-62664](https://cve.now/CVE-2025-62664.md): Stored XSS through a system message in ImageRating (CVSS 6.9)
- [CVE-2025-62655](https://cve.now/CVE-2025-62655.md): SQL injection in Cargo via Special:CargoExport (CVSS 2.1)
- [CVE-2025-62654](https://cve.now/CVE-2025-62654.md): Stored XSS through system messages in QuizGame (CVSS 2.0)
- [CVE-2025-62653](https://cve.now/CVE-2025-62653.md): Stored XSS through system messages in PollNY (CVSS 2.0)
- [CVE-2025-62652](https://cve.now/CVE-2025-62652.md): Stored XSS in WebAuthn key name (CVSS 5.8)
- [CVE-2025-32077](https://cve.now/CVE-2025-32077.md): XSSes in Extension:SimpleCalendar (CVSS 6.9)
- [CVE-2025-32078](https://cve.now/CVE-2025-32078.md): XSSes and potential RCE in Special:VersionCompare (CVSS 6.9)
- [CVE-2025-32079](https://cve.now/CVE-2025-32079.md): Saving the right content to MediaWiki:GrowthMentors.json can take down the site (CVSS 6.5)
- [CVE-2025-32080](https://cve.now/CVE-2025-32080.md): Cross-origin data leak in mobilefrontend via lazy load images (CVSS 6.9)
- [CVE-2025-32076](https://cve.now/CVE-2025-32076.md): Evil regex used to process user-provided data in VisualData (CVSS 6.9)
- [CVE-2025-32072](https://cve.now/CVE-2025-32072.md): HTML injection in feed output from i18n message (CVSS 6.9)
- [CVE-2025-32073](https://cve.now/CVE-2025-32073.md): System message XSS in HTMLTags (CVSS 5.4)
- [CVE-2025-32074](https://cve.now/CVE-2025-32074.md): XSSes in Extension:ConfirmAccount (CVSS 5.4)
- [CVE-2025-32075](https://cve.now/CVE-2025-32075.md): IP and user agent leaks in Extension:Tabs (CVSS 6.9)
- [CVE-2025-32067](https://cve.now/CVE-2025-32067.md): i18n XSS vulnerability in message growthexperiments (CVSS 5.4)
- [CVE-2025-32068](https://cve.now/CVE-2025-32068.md): Revoking authorization of OAuth2 consumer does not invalidate refresh tokens (CVSS 5.4)
- [CVE-2025-32069](https://cve.now/CVE-2025-32069.md): Wikitext stored XSS on filepages due to dangerous WBMI serialization (CVSS 5.4)
- [CVE-2025-32070](https://cve.now/CVE-2025-32070.md): XSSes in AJAXPoll (CVSS 5.4)
- [CVE-2025-32071](https://cve.now/CVE-2025-32071.md): Wikibase CommonsInlineImageFormatter: i18n XSS (CVSS 5.4)
- [CVE-2024-47841](https://cve.now/CVE-2024-47841.md): Path traversal when loading stylesheets (CVSS 6.9)
- [CVE-2024-47840](https://cve.now/CVE-2024-47840.md): Stored XSS through sidebar in Apex skin (CVSS 6.9)
- [CVE-2024-47847](https://cve.now/CVE-2024-47847.md): Various XSSes found in Cargo (CVSS 6.9)
- [CVE-2024-47846](https://cve.now/CVE-2024-47846.md): Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection (CVSS 6.9)
- [CVE-2024-47849](https://cve.now/CVE-2024-47849.md): Backticks can allow the usage of not-allowed SQL functions (CVSS 8.8)
- [CVE-2024-47845](https://cve.now/CVE-2024-47845.md): CSS sanitizer used incorrectly, and is easily bypassed (CVSS 6.9)
- [CVE-2024-47848](https://cve.now/CVE-2024-47848.md): User can review/unreview articles while blocked (CVSS 6.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/the-wikimedia-foundation
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.