Skip to content
OpenAdvisories

Vendor

The Wikimedia Foundation

98 known vulnerabilities.

Products

Mediawiki - Cargo extension 11 MediaWiki WikiLambda extension 5 MediaWiki CentralAuth extension 4 Mediawiki - GrowthExperiments Extension 4 Mediawiki - Cargo 3 Mediawiki - Wikilove Extension 2 MediaWiki PageTriage extension 2 Mediawiki - CSS Extension 2 MediaWiki Wikibase extension 2 Mediawiki - CirrusSearch Extension 2 Mediawiki - AdvancedSearch Extension 1 MediaWiki WebAuthn extension 1 MediaWiki QuizGame extension 1 MediaWiki GlobalBlocking extension 1 Mediawiki - UploadWizard Extension 1 Mediawiki - RedirectManager Extension 1 Mediawiki - DiscussionTools Extension 1 Mediawiki - GlobalWatchlist Extension 1 Mediawiki - Score Extension 1 MediaWiki PageForms extension 1 MediaWiki WikiForum extension 1 MediaWiki Wikistories extension 1 Mediawiki - Tabs Extension 1 Mediawiki - Apex skin 1 Mediawiki - AJAX Poll Extension 1 Mediawiki - Mobile Frontend Extension 1 Mediawiki - MultiBoilerplate Extensionmaste 1 Mediawiki - Extension:SimpleCalendar 1 Mediawiki - FlexDiagrams Extension 1 MediaWiki ReadingLists extension 1 Mediawiki - EasyTimeline extension 1 Mediawiki - CentralNotice extension 1 Mediawiki - ImageRating Extension 1 Mediawiki - GrowthExperiments 1 Mediawiki - Wikistories 1 Mediawiki - Visual Data Extension 1 Mediawiki - Growth Experiments Extension 1 MediaWiki PollNY extension 1 Mediawiki - Refreshed skin 1 MediaWiki MediaSearch extension 1
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Low 1.2
    CVE-2026-103585 Public exploit

    attacker-controlled javascript license URL via XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki MediaSearch extension Web / CMS
  • Low 1.1
    CVE-2026-103584 Public exploit

    attacker-controlled javascript license URL via XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, …

    The Wikimedia Foundation MediaWiki CommonsMetadata extension Web / CMS
  • Low 1.2
    CVE-2026-103440 Public exploit

    pagetriagelist discloses suppressed reviewer usernames

    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki PageTriage extension Web / CMS
  • Low 1.1
    CVE-2026-103437 Public exploit

    ReadingLists imported metadata permits JavaScript URL XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

    The Wikimedia Foundation MediaWiki ReadingLists extension Web / CMS
  • High 7.4
    CVE-2026-103446 Public exploit

    WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

    Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS
  • Low 1.2
    CVE-2026-103445 Public exploit

    Stored XSS through PageForms #autoedit redirect links

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Page_Forms extension Web / CMS
  • High 7.2
    CVE-2026-103442 Public exploit

    MergeAccount PHP object injection via session-key substitution

    External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki CentralAuth extension Web / CMS
  • High 7.2
    CVE-2026-103441 Public exploit

    Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

    Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikibase extension Web / CMS
  • Medium 6.9
    CVE-2026-96878 Public exploit

    Cargo Exhibit field alias allows stored XSS

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96877 Public exploit

    Reflected XSS through Cargo Drilldown full-text search

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96876 Public exploit

    Anonymous reflected XSS in CargoExport invalid-alias errors

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96875 Public exploit

    Reflected XSS in Cargo Drilldown hierarchy filters

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Low 2.3
    CVE-2026-96874 Public exploit

    Stored XSS in Cargo Drilldown tab names

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 5.5
    CVE-2026-96873 Public exploit

    Reflected XSS in CirrusSearch debug explain output

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.

    The Wikimedia Foundation Mediawiki - CirrusSearch Extension Web / CMS
  • Low 2.9
    CVE-2026-96872 Public exploit

    WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

    Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki -…

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS