Cross-Site Scripting Exposure in MediaWiki by Wikimedia Foundation
CVE-2025-67481

NONE

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki
Vendor
CVE Published:
3 February 2026

What is CVE-2025-67481?

A Cross-Site Scripting (XSS) vulnerability exists in specific versions of MediaWiki from Wikimedia Foundation. The flaw arises due to improper neutralization of input during web page generation. Attackers could exploit this vulnerability to inject malicious scripts into web pages viewed by other users, potentially compromising sensitive user information or performing unauthorized actions. This affects versions of MediaWiki prior to 1.39.16, along with 1.43.6, 1.44.3, and 1.45.1, allowing malicious actors to manipulate the content displayed to users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MediaWiki * < 1.39.16, 1.43.6, 1.44.3, 1.45.1

References

https://phabricator.wikimedia.org/T251032

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.