Stored XSS Vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension
CVE-2025-53494

6.5MEDIUM

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Twocolconflict Extension
Vendor
CVE Published:
2 July 2025

What is CVE-2025-53494?

A stored Cross-site Scripting (XSS) vulnerability in the TwoColConflict extension of the Mediawiki platform allows an attacker to inject malicious scripts into web pages, which could be executed in the context of users visiting those pages. This issue arises due to improper neutralization of user input during web page generation, affecting versions prior to the specified patches. It is crucial for users of this extension to update to the fixed versions to mitigate potential security threats.

Affected Version(s)

Mediawiki - TwoColConflict Extension 1.39.x < 1.39.13

Mediawiki - TwoColConflict Extension 1.42.x < 1.42.7

Mediawiki - TwoColConflict Extension 1.43.x < 1.43.2

References

https://phabricator.wikimedia.org/T394938
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Two...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SomeRandomDeveloper
.
CVE-2025-53494 : Stored XSS Vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension