Cross-Site Scripting Vulnerability in Wikimedia's SecurePoll Extension

CVE-2025-11937

What is CVE-2025-11937?

The SecurePoll Extension of MediaWiki from the Wikimedia Foundation is affected by a Cross-Site Scripting (XSS) vulnerability, allowing attackers to inject malicious scripts that can be executed in the context of the user's session. This can lead to unauthorized actions being performed on behalf of victims or sensitive information being exposed. The vulnerability arises from improper handling of user inputs during website generation, highlighting the importance of sanitizing data to prevent such exploits.

References