Cross-site Scripting Flaw in MediaWiki GlobalBlocking Extension by Wikimedia Foundation

CVE-2025-62656

What is CVE-2025-62656?

The MediaWiki GlobalBlocking extension has a vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, resulting in stored cross-site scripting (XSS). This flaw could enable unauthorized actions on behalf of unsuspecting users, compromising sensitive data and user interactions. Affected versions include 1.43 and 1.44 of the MediaWiki GlobalBlocking extension. Proper input validation and sanitization are crucial to mitigate this security risk.

References