Stored Cross-Site Scripting Vulnerability in Citizen MediaWiki Skin
CVE-2025-62508

6.5MEDIUM

Key Information:

Vendor: Starcitizentools
Status: Mediawiki-skins-citizen
Vendor: CVE Published:; 17 October 2025

🔔 Create Starcitizentools Vulnerability Alert

What is CVE-2025-62508?

The Citizen MediaWiki skin, from versions 3.3.0 to 3.9.0, is susceptible to a stored cross-site scripting vulnerability. This arises from the improper handling of innerHTML content in the sticky header button message. Specifically, the 'copyButtonAttributes' function in 'stickyHeader.js' allows a user with edit interface permissions to execute arbitrary JavaScript in other users' sessions. This could lead to unauthorized access, enabling attackers to manipulate the interface and potentially compromise sensitive information. The vulnerability has been addressed in version 3.9.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch