Cross-Site Scripting Vulnerability in Wikimedia Foundation's Mediawiki UploadWizard Extension

CVE-2025-62663

What is CVE-2025-62663?

The UploadWizard Extension of Mediawiki experienced a vulnerability that allows Stored Cross-Site Scripting (XSS). This flaw arises from improper neutralization of input during web page generation, potentially allowing attackers to inject malicious scripts that could execute in the context of users’ browsers. As a result, sensitive user interactions could be exploited, leading to unauthorized access or data manipulation. Users are advised to update to the latest version to mitigate this risk.

References