THE Wikimedia Foundation vulnerabilities
98 CVEs and advisories name THE Wikimedia Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-62698Stored XSS through system messages in ExternalGuidance
- CVE-2025-62700Stored XSS through a system message in MultiBoilerplate
- CVE-2025-62693Stored XSS through system messages in LastModified
- CVE-2025-11937Stored XSS through a system message in SecurePoll
- CVE-2025-62666DoS vector through the cirrusbuilddoc query API
- CVE-2025-62667Stored XSS through article extracts in GrowthExperiments
- CVE-2025-62668Insufficient permission checks in action=growthsetmentor
- CVE-2025-62669UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks
- CVE-2025-62670Stored XSS through a system message in FlexDiagrams
- CVE-2025-62671Stored XSS through wikitext in Cargo
- CVE-2025-62662Stored XSS through system messages in AdvancedSearch
- CVE-2025-62663Stored XSS through a system message in UploadWizard
- CVE-2025-62664Stored XSS through a system message in ImageRating
- CVE-2025-62655SQL injection in Cargo via Special:CargoExport
- CVE-2025-62654Stored XSS through system messages in QuizGame
- CVE-2025-62653Stored XSS through system messages in PollNY
- CVE-2025-62652Stored XSS in WebAuthn key name
- CVE-2025-32077XSSes in Extension:SimpleCalendar
- CVE-2025-32078XSSes and potential RCE in Special:VersionCompare
- CVE-2025-32079Saving the right content to MediaWiki:GrowthMentors.json can take down the site
- CVE-2025-32080Cross-origin data leak in mobilefrontend via lazy load images
- CVE-2025-32076Evil regex used to process user-provided data in VisualData
- CVE-2025-32072HTML injection in feed output from i18n message
- CVE-2025-32073System message XSS in HTMLTags
- CVE-2025-32074XSSes in Extension:ConfirmAccount
- CVE-2025-32075IP and user agent leaks in Extension:Tabs
- CVE-2025-32067i18n XSS vulnerability in message growthexperiments
- CVE-2025-32068Revoking authorization of OAuth2 consumer does not invalidate refresh tokens
- CVE-2025-32069Wikitext stored XSS on filepages due to dangerous WBMI serialization
- CVE-2025-32070XSSes in AJAXPoll