Skip to content
OpenAdvisories

Vendor

The Wikimedia Foundation

98 known vulnerabilities.

Products

Mediawiki - Cargo extension 11 MediaWiki WikiLambda extension 5 MediaWiki CentralAuth extension 4 Mediawiki - GrowthExperiments Extension 4 Mediawiki - Cargo 3 Mediawiki - Wikilove Extension 2 MediaWiki PageTriage extension 2 Mediawiki - CSS Extension 2 MediaWiki Wikibase extension 2 Mediawiki - CirrusSearch Extension 2 Mediawiki - AdvancedSearch Extension 1 MediaWiki WebAuthn extension 1 MediaWiki QuizGame extension 1 MediaWiki GlobalBlocking extension 1 Mediawiki - UploadWizard Extension 1 Mediawiki - RedirectManager Extension 1 Mediawiki - DiscussionTools Extension 1 Mediawiki - GlobalWatchlist Extension 1 Mediawiki - Score Extension 1 MediaWiki PageForms extension 1 MediaWiki WikiForum extension 1 MediaWiki Wikistories extension 1 Mediawiki - Tabs Extension 1 Mediawiki - Apex skin 1 Mediawiki - AJAX Poll Extension 1 Mediawiki - Mobile Frontend Extension 1 Mediawiki - MultiBoilerplate Extensionmaste 1 Mediawiki - Extension:SimpleCalendar 1 Mediawiki - FlexDiagrams Extension 1 MediaWiki ReadingLists extension 1 Mediawiki - EasyTimeline extension 1 Mediawiki - CentralNotice extension 1 Mediawiki - ImageRating Extension 1 Mediawiki - GrowthExperiments 1 Mediawiki - Wikistories 1 Mediawiki - Visual Data Extension 1 Mediawiki - Growth Experiments Extension 1 MediaWiki PollNY extension 1 Mediawiki - Refreshed skin 1 MediaWiki MediaSearch extension 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Low 1.2
    CVE-2026-103585 Public exploit

    attacker-controlled javascript license URL via XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki MediaSearch extension Web / CMS
  • Low 1.1
    CVE-2026-103584 Public exploit

    attacker-controlled javascript license URL via XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, …

    The Wikimedia Foundation MediaWiki CommonsMetadata extension Web / CMS
  • Low 1.2
    CVE-2026-103440 Public exploit

    pagetriagelist discloses suppressed reviewer usernames

    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki PageTriage extension Web / CMS
  • Low 1.1
    CVE-2026-103437 Public exploit

    ReadingLists imported metadata permits JavaScript URL XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

    The Wikimedia Foundation MediaWiki ReadingLists extension Web / CMS
  • Low 1.2
    CVE-2026-103445 Public exploit

    Stored XSS through PageForms #autoedit redirect links

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Page_Forms extension Web / CMS
  • Low 2.3
    CVE-2026-96874 Public exploit

    Stored XSS in Cargo Drilldown tab names

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Low 2.9
    CVE-2026-96872 Public exploit

    WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

    Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki -…

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS