Stored XSS Vulnerability in ApprovedRevs for MediaWiki
CVE-2025-53487

Currently unrated

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Approvedrevs Extension
Vendor
CVE Published:
7 July 2025

What is CVE-2025-53487?

The ApprovedRevs extension for MediaWiki is susceptible to stored Cross-Site Scripting (XSS) attacks due to improper handling of system messages. Attackers can exploit this vulnerability by injecting malicious JavaScript through the uselang=x-xss language override feature, leading to the execution of unescaped, crafted message keys. This can pose significant security risks, allowing unauthorized access to user data and potential control over user sessions.

Affected Version(s)

Mediawiki - ApprovedRevs extension 1.39.x < 1.39.13

Mediawiki - ApprovedRevs extension 1.42.x < 1.42.7

Mediawiki - ApprovedRevs extension 1.43.x < 1.43.2

References

https://phabricator.wikimedia.org/T394383
https://gerrit.wikimedia.org/r/q/Ifcab085111e7898da485a5e...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53487 : Stored XSS Vulnerability in ApprovedRevs for MediaWiki