Cross-Site Scripting Vulnerability in Wikimedia Foundation MediaWiki GrowthExperiments Extension
CVE-2025-62667

6.9MEDIUM

Key Information:

Vendor

The Wikimedia Foundation

Status
Mediawiki - Growthexperiments Extension
Vendor
CVE Published:
18 October 2025

What is CVE-2025-62667?

A cross-site scripting (XSS) vulnerability exists in the MediaWiki GrowthExperiments Extension, which allows an attacker to inject malicious scripts into web pages viewed by users. This could lead to unauthorized actions, data theft, or other security breaches. Users running affected versions of the extension should take precautions to mitigate this vulnerability by upgrading to a secure release.

Affected Version(s)

Mediawiki - GrowthExperiments Extension master < 1.39

References

https://phabricator.wikimedia.org/T402698
https://gerrit.wikimedia.org/r/q/Iafd0acccf9a5c20d9e955d7...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SomeRandomDeveloper
JSON
.
CVE-2025-62667 : Cross-Site Scripting Vulnerability in Wikimedia Foundation MediaWiki GrowthExperiments Extension