Cross-Site Scripting Vulnerability in Wikimedia Foundation's CheckUser
CVE-2025-61651

NONE

Key Information:

Vendor

Wikimedia Foundation

Status
Checkuser
Vendor
CVE Published:
3 February 2026

What is CVE-2025-61651?

A Cross-Site Scripting (XSS) vulnerability exists in Wikimedia Foundation's CheckUser prior to version 1.44.1. The vulnerability stems from improper neutralization of input during web page generation within specific program files. This flaw may allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to unauthorized actions and data compromise.

Affected Version(s)

CheckUser * < 1.44.1

References

https://phabricator.wikimedia.org/T403408

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.