THE Wikimedia Foundation vulnerabilities
98 CVEs and advisories name THE Wikimedia Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-14358Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title
- CVE-2026-58517Blocked users can create and edit WikiLambda objects
- CVE-2026-58521SQLi in Cargo extension via year range filter
- CVE-2026-58520UrlShortener defaults to ineffective validation open to third-party redirects
- CVE-2026-58519Stored XSS through Cargo's map format
- CVE-2026-58518Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request
- CVE-2026-39936Stored XSS in Score due to usage of non-reserved data attributes
- CVE-2026-39935XSS-via-i18n in localised wiki names
- CVE-2026-39934Growth Experiments ReassignMenteesJob runs as an infinite loop
- CVE-2026-39933Multiple XSS vulnerabilities in GlobalWatchlist
- CVE-2026-39937Global vanishing does not completely remove user email
- CVE-2026-22711Stored XSS through system messages in WikiLove
- CVE-2025-11175DiscussionTools should use better regex
- CVE-2026-22712ApprovedRevs allows bypassing the inline CSS sanitizer
- CVE-2026-22713Stored XSS through edit summaries in GrowthExperiments
- CVE-2026-22714i18n XSS, DoS and config SQLI in Monaco
- CVE-2026-22710Stored XSS through autocomment system messages in Wikibase
- CVE-2025-62659The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors
- CVE-2025-62661Do permission checking when getting counts of global and local edits, new articles and thanks
- CVE-2025-12004The compare API module breaks Extension:Lockdown
- CVE-2025-62701Stored XSS through system messages
- CVE-2025-62702Stored XSS through system messages
- CVE-2025-62694Stored XSS through a system message
- CVE-2025-62695Stored XSS through system messages
- CVE-2025-62696Multiple critical security issues in Springboard
- CVE-2025-62699Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool
- CVE-2025-62658SQL injection in WatchAnalytics through Special:ClearPendingReviews
- CVE-2025-62657Stored XSS through system messages in PageForms
- CVE-2025-62656GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS
- CVE-2025-62697Improperly sanitized style parameter in LanguageSelector