Wikimedia Foundation vulnerabilities
152 CVEs and advisories name Wikimedia Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-6591HTML injection in API action=feedcontributions output from i18n message
- CVE-2025-6592Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog
- CVE-2025-6593"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses
- CVE-2025-6594XSS in Special:ApiSandbox
- CVE-2025-6595Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Multimedia
- CVE-2025-6596Vector inserts portlet labels as HTML, allowing for stored XSS through system messages
- CVE-2025-6597MediaWiki should not consider autocreation as login for the purposes of security reauthentication
- CVE-2025-6927Autoblocks from global account suppressions are publicly visible
- CVE-2026-0817CampaignEvents API missing authorization exposes meeting and chat URLs
- CVE-2026-0671Multiple stored i18n/message-key XSSes in UploadWizard
- CVE-2026-0670Stored XSS through a system message and a user-provided parameter in ProofreadPage
- CVE-2026-0669Path Traversal vulnerability in CSS extension on certain web servers
- CVE-2026-0668VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user input
- CVE-2025-52738WordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerability
- CVE-2025-62665Stored XSS through system messages in Skin:BlueSky
- CVE-2025-7363TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser function
- CVE-2025-7362MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message
- CVE-2025-53479CheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized message
- CVE-2025-53480CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages
- CVE-2025-53496Stored XSS in MediaSearch
- CVE-2025-53488Stored XSS in WikiHiero
- CVE-2025-53498Lack of Audit Logging in AbuseFilter
- CVE-2025-53499Unauthorized Inspection of Protected Variables in AbuseFilter
- CVE-2025-53495Unauthorized Disclosure of IP Reputation in AbuseFilter
- CVE-2025-53478CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messages
- CVE-2025-53497Stored XSS in RelatedArticles
- CVE-2025-53491XSS in FlaggedRevs
- CVE-2025-53487ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messages
- CVE-2025-7057Stored XSS in Quiz
- CVE-2025-53486WikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser function