Cross-site Scripting Vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extension

CVE-2025-53488

What is CVE-2025-53488?

A cross-site scripting (XSS) vulnerability exists in the WikiHiero Extension of Wikimedia's Mediawiki framework, allowing attackers to inject malicious scripts. This stored XSS issue affects versions of the extension prior to 1.43.2, which can lead to unauthorized actions being performed on behalf of users or sensitive information being exposed. Proper validation and sanitization of user inputs are essential to mitigate this risk and protect user data.

References