Wikimedia Foundation vulnerabilities

Products

• MediaWiki 55
• CheckUser 9
• Mediawiki - Cargo Extension 4
• AbuseFilter 3
• Mediawiki - AbuseFilter Extension 3
• Mediawiki - CheckUser extension 3
• Mediawiki - SecurePoll extension 3
• MediaWiki - CampaignEvents extension 2
• Mediawiki - CentralAuth Extension 2
• Mediawiki - DataTransfer Extension 2
• Mediawiki - IPInfo Extension 2
• Mediawiki - MintyDocs Extension 2
• MediaWiki - ProofreadPage Extension 2
• Mediawiki - TemplateSandbox Extension 2
• MediaWiki - UploadWizard extension 2
• Mediawiki - Wikibase Extension 2
• Mediawiki - WikiLambda Extension 2
• OATHAuth 2
• Parsoid 2
• Scribunto 2
• timeline 2
• Vector 2
• VisualEditor 2
• CentralAuth 1
• Cite 1
• ConfirmEdit 1
• DiscussionTools 1
• Echo 1
• luasandbox 1
• Mediawiki - ApprovedRevs extension 1

Latest Wikimedia Foundation CVEs

Newest publication first · page 1 of 7

1. CVE-2026-102796 Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

   Published 2026-09-29

   High·CVSS 7.5 EPSS 0.31%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1...

2. CVE-2026-100245 Stored XSS on Wikibase Special:SetSiteLink via unescaped system message

   Published 2026-09-29

   Medium·CVSS 6.1 EPSS 0.16%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.

3. CVE-2026-100244 CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

   Published 2026-09-29

   High·CVSS 7.5 EPSS 0.26%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.

4. CVE-2026-100243 Stored XSS in WikiSEO author and image properties on action=info

   Published 2026-09-29

   Medium·CVSS 6.1 EPSS 0.16%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from * before 1.46.1, 1.45.5, 1.43.10.

5. CVE-2026-100242 DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

   Published 2026-09-29

   High·CVSS 7.5 EPSS 0.41%

   Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.

6. CVE-2026-100241 Private change tags exposed to anonymous users via revision-tags-change events

   Published 2026-09-29

   High·CVSS 7.5 EPSS 0.31%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.

7. CVE-2026-100240 TemplateSandbox does not check read permissions for the page being previewed

   Published 2026-09-29

   Critical·CVSS 9.1 EPSS 0.30%

   Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

8. CVE-2026-100238 Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

   Published 2026-09-29

   Medium·CVSS 6.1 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10.

9. CVE-2026-100383 Stored i18n XSS in WikiLambda's VisualEditor integration

   Published 2026-09-25

   Medium·CVSS 4.8 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has b...

10. CVE-2026-100382 Unauthenticated remote code execution through wikitext in ExternalData

    Published 2026-09-25

    Critical·CVSS 10.0 EPSS 1.2%

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

11. CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS

    Published 2026-09-25

    Medium·CVSS 5.3 EPSS 0.42%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.4...

12. CVE-2026-100380 Reflected XSS in Wikibase Special:SetLabel language validation

    Published 2026-09-25

    Medium·CVSS 5.3 EPSS 0.42%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.4...

13. CVE-2026-100379 Cross-request disclosure of CentralAuth cookies in Wikipedia Android App

    Published 2026-09-25

    Medium·CVSS 5.3 EPSS 0.39%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main.

14. CVE-2026-100378 Missing permission check in the Translate sandbox doRemind action

    Published 2026-09-25

    Medium·CVSS 5.3 EPSS 0.27%

    Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.

15. CVE-2026-100376 TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix

    Published 2026-09-25

    Medium·CVSS 4.8 EPSS 0.30%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46....

16. CVE-2026-100377 Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract

    Published 2026-09-25

    Medium·CVSS 6.9 EPSS 0.32%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch.

17. CVE-2026-58025 Remote Code Execution via Unsafe Deserialization in LogItem Import

    Published 2026-07-01

    Medium·CVSS 5.9 EPSS 0.50%

    Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * befor...

18. CVE-2026-58029 Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

    Published 2026-07-01

    Medium·CVSS 5.3 EPSS 0.35%

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Sp...

19. CVE-2026-58028 Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

    Published 2026-07-01

    None·CVSS 0.0 EPSS 0.27%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp....

20. CVE-2026-58026 $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

    Published 2026-07-01

    None·CVSS 0.0 EPSS 0.37%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

21. CVE-2026-8857 Full RCE using EasyTimeline Extension

    Published 2026-07-01

    None·CVSS 0.0 EPSS 2.1%

    A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

22. CVE-2026-58038 Stored XSS through javascript URLs in SVGs generated by EasyTimeline

    Published 2026-07-01

    None·CVSS 0.0 EPSS 0.27%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * befo...

23. CVE-2026-58027 QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

    Published 2026-07-01

    Medium·CVSS 5.3 EPSS 0.37%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

24. CVE-2026-58030 SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

    Published 2026-07-01

    Medium·CVSS 5.3 EPSS 0.27%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: fro...

25. CVE-2026-58032 mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

    Published 2026-07-01

    Medium·CVSS 5.3 EPSS 0.30%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.