Cross-Site Scripting Vulnerability in Mediawiki CampaignEvents Extension by Wikimedia Foundation
CVE-2025-53490

5.6MEDIUM

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Campaignevents Extension
Vendor
CVE Published:
3 July 2025

What is CVE-2025-53490?

The Mediawiki - CampaignEvents Extension by Wikimedia Foundation contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability enables attackers to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking, defacement, or redirection to malicious sites. This issue affects versions of the extension prior to 1.43.2.

Affected Version(s)

Mediawiki - CampaignEvents Extension 1.43.x < 1.43.2

References

https://phabricator.wikimedia.org/T395622
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cam...

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daimona
.
CVE-2025-53490 : Cross-Site Scripting Vulnerability in Mediawiki CampaignEvents Extension by Wikimedia Foundation