Reflected XSS Vulnerability in MediaWiki's WikiCategoryTagCloud Extension

CVE-2025-53486

What is CVE-2025-53486?

The WikiCategoryTagCloud extension for MediaWiki is susceptible to reflected Cross-Site Scripting (XSS) attacks due to improper handling of the linkstyle attribute. This vulnerability arises from direct insertion of unsanitized user input into HTML, allowing attackers to inject malicious JavaScript through the {{#tag:tagcloud}} parser function. Consequently, this can lead to arbitrary JavaScript execution when users interact with links within the category cloud, posing significant risks for web application integrity and user safety.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References