Reflected XSS Vulnerability in MediaWiki's WikiCategoryTagCloud Extension
CVE-2025-53486
Currently unrated
What is CVE-2025-53486?
The WikiCategoryTagCloud extension for MediaWiki is susceptible to reflected Cross-Site Scripting (XSS) attacks due to improper handling of the linkstyle attribute. This vulnerability arises from direct insertion of unsanitized user input into HTML, allowing attackers to inject malicious JavaScript through the {{#tag:tagcloud}} parser function. Consequently, this can lead to arbitrary JavaScript execution when users interact with links within the category cloud, posing significant risks for web application integrity and user safety.
Affected Version(s)
Mediawiki - WikiCategoryTagCloud extension 1.39.x < 1.39.13
Mediawiki - WikiCategoryTagCloud extension 1.42.x < 1.42.7
Mediawiki - WikiCategoryTagCloud extension 1.43.x < 1.43.2