Skip to content
OpenAdvisories
Medium WID-SEC-2026-0053 5 CVEs

MediaWiki: Mehrere Schwachstellen

Published Jan 8, 2026 · Updated Jan 11, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um Daten zu manipulieren.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 5

  • Medium 6.1
    CVE-2026-0671

    Multiple stored i18n/message-key XSSes in UploadWizard

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - UploadWizard extension: 1.45,…

    Wikimedia Foundation Mediawiki - UploadWizard Extension Web / CMS
  • Low 2.3
    CVE-2026-22710

    Stored XSS through autocomment system messages in Wikibase

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.4…

    The Wikimedia Foundation MediaWiki Wikibase extension Web / CMS
  • Low 2.3
    CVE-2026-22712

    ApprovedRevs allows bypassing the inline CSS sanitizer

    Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1…

    The Wikimedia Foundation Mediawiki - ApprovedRevs Extension Web / CMS
  • Low 2.3
    CVE-2026-22713

    Stored XSS through edit summaries in GrowthExperiments

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GrowthExperiments Ex…

    The Wikimedia Foundation Mediawiki - GrowthExperiments Extension Web / CMS
  • Low 2.3
    CVE-2026-22714

    i18n XSS, DoS and config SQLI in Monaco

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Monaco Skin: 1.45, 1.44, 1.43, 1.39.

    The Wikimedia Foundation Mediawiki - Monaco Skin Web / CMS

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-1820, EUVD-2026-1821, EUVD-2026-1816, EUVD-2026-1819

  2. #1

    Initiale Fassung

References