mediawiki vulnerabilities

Products

• mediawiki 419
• mediawiki/core 28
• mediawiki/semantic-media-wiki 19
• mediawiki/cargo 12
• checkuser 9
• abusefilter 3
• visual editor 3
• mobilefrontend 2
• createredirect 1
• MassMessage 1
• mediawik 1
• mediawiki (SyntaxHighlight extension) 1
• mediawiki botquery ext 1
• mediawiki/abuse-filter 1
• mediawiki/data-transfer 1
• mediawiki/maps 1
• mediawiki/matomo 1
• metrolook skin 1
• ProofreadPage 1
• rss for mediawiki 1
• rssreader 1
• score 1
• scribunto 1
• semantic drilldown 1
• shortdescription 1
• skincosmos 1
• vector skin 1
• wikisource category browser 1

Latest mediawiki CVEs

Newest publication first · page 1 of 20

1. CVE-2026-126567 Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output

   Published 2026-11-11

   Medium·CVSS 5.1 EPSS 0.23%

   Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text pro...

2. CVE-2026-126566 Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations

   Published 2026-11-11

   High·CVSS 7.1 EPSS 0.39%

   Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded...

3. CVE-2026-126565 Semantic MediaWiki 3.0.0 before 7.4.1 DoS via Exponential Concept Expansion

   Published 2026-11-11

   Medium·CVSS 5.3 EPSS 0.38%

   Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of...

4. CVE-2026-126564 Semantic MediaWiki 2.5.0 before 7.4.1 Stored XSS via Special:Browse Factbox Title

   Published 2026-11-11

   Medium·CVSS 5.1 EPSS 0.22%

   Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal as unescaped markup. Users with page-edit rights can set a preferred property label containing...

5. CVE-2026-126563 Semantic MediaWiki 2.4.0 before 7.4.1 Reflected XSS via Special:Ask Date Format

   Published 2026-11-11

   Medium·CVSS 5.3 EPSS 0.27%

   Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup...

6. CVE-2026-126562 Semantic MediaWiki 3.0.0 before 7.4.1 Uncontrolled Recursion via ElasticStore ConceptDescriptionInterpreter

   Published 2026-11-11

   Medium·CVSS 5.3 EPSS 0.35%

   Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concep...

7. CVE-2026-126561 Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation

   Published 2026-11-11

   High·CVSS 7.1 EPSS 0.37%

   Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transclu...

8. CVE-2026-126560 Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via data-search Attributes

   Published 2026-11-11

   Medium·CVSS 5.1 EPSS 0.22%

   Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter ce...

9. CVE-2026-126559 Semantic MediaWiki 4.2.0 before 7.4.1 Stored XSS via Special:FacetedSearch

   Published 2026-11-11

   Medium·CVSS 4.8 EPSS 0.24%

   Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of opti...

10. CVE-2026-116890 Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

    Published 2026-10-27

    Medium·CVSS 6.9 EPSS 0.20%

    Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics,...

11. CVE-2026-116891 SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate

    Published 2026-10-27

    Medium·CVSS 5.1 EPSS 0.17%

    SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, a...

12. CVE-2026-77616 Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

    Published 2026-09-18

    Medium·CVSS 6.1 EPSS 0.33%

    Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, Special:Ask accepts a cursor query parameter for keyset pagination (added in 7.0.0). The token is decoded by CursorEncod...

13. CVE-2026-77610 Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

    Published 2026-09-18

    Medium·CVSS 6.1 EPSS 0.28%

    Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output (format=debug, or the debug request parameter on Special:Ask) is assembled by SMW\Query\DebugFormatter and emi...

14. CVE-2026-77609 Semantic MediaWiki has an open redirect in Special:URIResolver

    Published 2026-09-18

    Medium·CVSS 6.1 EPSS 0.27%

    Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, Special:URIResolver resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to $title->getFullU...

15. CVE-2026-77607 Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

    Published 2026-09-18

    Medium·CVSS 6.1 EPSS 0.28%

    Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 f...

16. CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

    Published 2026-09-18

    Medium·CVSS 6.1 EPSS 0.28%

    Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding...

17. CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

    Published 2026-09-18

    Medium·CVSS 6.1 EPSS 0.26%

    Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefor...

18. CVE-2025-61682 Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

    Published 2026-09-18

    High·CVSS 8.6 EPSS 0.40%

    Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wiki...

19. CVE-2024-23176 An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.

    Published 2026-09-14

    Medium·CVSS 5.4 EPSS 0.24%

    An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.

20. CVE-2023-37252 An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.

    Published 2026-09-14

    Low·CVSS 3.1 EPSS 0.24%

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.

21. CVE-2023-37253 An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.

    Published 2026-09-14

    Low·CVSS 3.1 EPSS 0.24%

    An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.

22. CVE-2026-52854 mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function

    Published 2026-08-18

    High·CVSS 8.6 EPSS 0.58%

    Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaf...

23. CVE-2026-14363 Cargo Extension: SQLi in Special:Drilldown

    Published 2026-07-01

    Medium·CVSS 6.9 EPSS 0.52%

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

24. CVE-2026-14358 Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

    Published 2026-07-01

    Medium·CVSS 6.9 EPSS 0.30%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.

25. CVE-2026-58517 Blocked users can create and edit WikiLambda objects

    Published 2026-07-01

    Medium·CVSS 6.9 EPSS 0.33%

    Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.