Cross-site Scripting Vulnerability in Mediawiki's MassEditRegex Extension
CVE-2025-53500

5.6MEDIUM

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Masseditregex Extension
Vendor
CVE Published:
3 July 2025

What is CVE-2025-53500?

A Cross-site Scripting (XSS) vulnerability exists in the MassEditRegex Extension for Mediawiki, which allows attackers to inject malicious scripts. This vulnerability affects specific versions of the extension, enabling stored XSS attacks that could compromise user data or disrupt the application’s functionality. Users of affected versions are strongly advised to upgrade to the latest secure releases to mitigate the security risk.

Affected Version(s)

Mediawiki - MassEditRegex Extension 1.39.x < 1.39.13

Mediawiki - MassEditRegex Extension 1.42.x < 1.42.7

Mediawiki - MassEditRegex Extension 1.43.x < 1.43.2

References

https://phabricator.wikimedia.org/T397334
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Mas...

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SomeRandomDeveloper
.
CVE-2025-53500 : Cross-site Scripting Vulnerability in Mediawiki's MassEditRegex Extension