mediawiki visual editor vulnerabilities

Latest mediawiki visual editor CVEs

Newest publication first

1. CVE-2025-61655 Stored XSS through system messages in VisualEditor

   Published 2026-02-03

   None·CVSS 0.0 EPSS 0.18%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArtic...

2. CVE-2025-61656 XSS when pasting into VE

   Published 2026-02-03

   None·CVSS 0.0 EPSS 0.18%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.3...

3. CVE-2019-19708 The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.

   Published 2019-12-11

   Medium·CVSS 6.1 EPSS 0.72%

   The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.