Reflected XSS Vulnerability in MediaWiki CheckUser Extension

CVE-2025-53480

What is CVE-2025-53480?

The CheckUser extension in MediaWiki features a vulnerability within the Account information tab on the Special:Investigate page. This flaw arises due to certain internationalized messages being rendered without adequate escaping, enabling attackers to exploit this by appending certain parameters to the URL. Such exploitation can lead to reflected XSS, allowing malicious scripts to execute in the context of another user's session when the affected message keys are rendered in the user interface.

References