User Input Injection Vulnerability in Mediawiki SecurePoll Extension

CVE-2025-53484

What is CVE-2025-53484?

The SecurePoll extension for Mediawiki is affected by a user input injection vulnerability due to improperly escaped user-controlled inputs. Specifically, attackers can exploit user input in the VotePage.php file for poll options and in the ResultPage methods, getPagesTab() and getErrorsTab(), where user-controlled page names are used without proper validation. This allows potential malicious actors to inject JavaScript code, leading to compromised user sessions under specific conditions. Users of affected versions should take immediate action to mitigate this risk.

References