Cross-Site Scripting Vulnerability in Wikimedia Mediawiki GoogleDocs4MW Extension
CVE-2025-53489

5.6MEDIUM

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Googledocs4mw Extension
Vendor
CVE Published:
3 July 2025

What is CVE-2025-53489?

A Cross-Site Scripting (XSS) vulnerability exists in the Mediawiki - GoogleDocs4MW Extension, allowing attackers to inject malicious scripts into web pages viewed by users. This vulnerability affects versions of the extension prior to 1.42.7 in the 1.42.X series and prior to 1.43.2 in the 1.43.X series. Users of the Mediawiki platform are at risk and should ensure they update to the latest version to mitigate potential exploits.

Affected Version(s)

Mediawiki - GoogleDocs4MW Extension 1.42.x < 1.42.7

Mediawiki - GoogleDocs4MW Extension 1.43.x < 1.43.2

References

https://phabricator.wikimedia.org/T395949
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Goo...

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SomeRandomDeveloper
.
CVE-2025-53489 : Cross-Site Scripting Vulnerability in Wikimedia Mediawiki GoogleDocs4MW Extension