Wikimedia Foundation vulnerabilities
152 CVEs and advisories name Wikimedia Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-7056Stored XSS in UrlShortener
- CVE-2025-53485SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes
- CVE-2025-53484SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped input
- CVE-2025-53483SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery
- CVE-2025-53482IPInfo: Message key XSS through several IPInfo messages in infobox and popup
- CVE-2025-53481Denial of service vector on ipinfo/v0/norevision
- CVE-2025-6926Security Authentication Bypass in CentralAuth
- CVE-2025-53500Stored XSS in MassEditRegex
- CVE-2025-53501Content Access Bypass in Scribunto
- CVE-2025-53502HTML injection in FeaturedFeeds
- CVE-2025-53489XSS in GoogleDocs4MW
- CVE-2025-53490Multiple XSS in CampaignEvents
- CVE-2025-53492Stored XSS in MintyDocs
- CVE-2025-53493Stored XSS in MintyDocs
- CVE-2025-53494Stored XSS in TwoColConflict
- CVE-2025-32700AbuseFilter log interfaces expose global private and hidden filters when central DB is not available
- CVE-2025-32699Potential javascript injection attack enabled by Unicode normalization in Action API
- CVE-2025-32698LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions
- CVE-2025-32697Cascading protection is not preventing file reversions
- CVE-2025-32696"reupload-own" restriction can be bypassed by reverting file
- CVE-2025-3469i18n XSS vulnerability in HTMLMultiSelectField when sections are used
- CVE-2025-23074Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed)
- CVE-2025-23073API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter
- CVE-2025-23072XSS in Special:RefreshSpecial
- CVE-2025-23081Various security vulnerabilities in Extension:DataTransfer
- CVE-2025-23080XSSes in Special:BadgeView
- CVE-2025-23079XSSes in Extension:ArticleFeedbackv5
- CVE-2025-23078XSS in BreadCrumbs2
- CVE-2013-4572The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cac
- CVE-2013-6451Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote atta