Cross-Site Scripting Flaw in Wikimedia Foundation MediaWiki - HTML Tags
CVE-2025-32073

10CRITICAL

Key Information:

Vendor
The Wikimedia Foundation
Status
Mediawiki - Html Tags
Vendor
CVE Published:
11 April 2025

Summary

An improper input validation vulnerability in the HTML Tags extension for MediaWiki allows attackers to exploit Cross-Site Scripting (XSS) vulnerabilities. This weakness affects MediaWiki versions 1.39 through 1.43, enabling malicious users to inject arbitrary scripts into web pages viewed by other users, compromising their data and session integrity. Mitigation is recommended to prevent potential exploitation of this vulnerability.

Affected Version(s)

Mediawiki - HTML Tags 1.39 <= 1.43

References

https://phabricator.wikimedia.org/T386337
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/HTM...

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

BlankEclair
Yaron_Koren
.