Cross-Site Scripting Vulnerability in MediaWiki PageForms by Wikimedia Foundation

CVE-2025-62657

What is CVE-2025-62657?

A Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki PageForms extension developed by the Wikimedia Foundation. This flaw allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising sensitive information and user interactions. The issue specifically affects version 1.44 and can lead to stored XSS attacks, enabling malicious actors to execute scripts in the context of the user’s browser. It is crucial for users of the PageForms extension to apply security updates to mitigate these risks. For more detailed information, refer to the issue report on Phabricator.

References