Skip to content
OpenAdvisories

Vendor

The Wikimedia Foundation

98 known vulnerabilities.

Products

Mediawiki - Cargo extension 11 MediaWiki WikiLambda extension 5 MediaWiki CentralAuth extension 4 Mediawiki - GrowthExperiments Extension 4 Mediawiki - Cargo 3 Mediawiki - Wikilove Extension 2 MediaWiki PageTriage extension 2 Mediawiki - CSS Extension 2 MediaWiki Wikibase extension 2 Mediawiki - CirrusSearch Extension 2 Mediawiki - AdvancedSearch Extension 1 MediaWiki WebAuthn extension 1 MediaWiki QuizGame extension 1 MediaWiki GlobalBlocking extension 1 Mediawiki - UploadWizard Extension 1 Mediawiki - RedirectManager Extension 1 Mediawiki - DiscussionTools Extension 1 Mediawiki - GlobalWatchlist Extension 1 Mediawiki - Score Extension 1 MediaWiki PageForms extension 1 MediaWiki WikiForum extension 1 MediaWiki Wikistories extension 1 Mediawiki - Tabs Extension 1 Mediawiki - Apex skin 1 Mediawiki - AJAX Poll Extension 1 Mediawiki - Mobile Frontend Extension 1 Mediawiki - MultiBoilerplate Extensionmaste 1 Mediawiki - Extension:SimpleCalendar 1 Mediawiki - FlexDiagrams Extension 1 MediaWiki ReadingLists extension 1 Mediawiki - EasyTimeline extension 1 Mediawiki - CentralNotice extension 1 Mediawiki - ImageRating Extension 1 Mediawiki - GrowthExperiments 1 Mediawiki - Wikistories 1 Mediawiki - Visual Data Extension 1 Mediawiki - Growth Experiments Extension 1 MediaWiki PollNY extension 1 Mediawiki - Refreshed skin 1 MediaWiki MediaSearch extension 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-96878 Public exploit

    Cargo Exhibit field alias allows stored XSS

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96877 Public exploit

    Reflected XSS through Cargo Drilldown full-text search

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96876 Public exploit

    Anonymous reflected XSS in CargoExport invalid-alias errors

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96875 Public exploit

    Reflected XSS in Cargo Drilldown hierarchy filters

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 5.5
    CVE-2026-96873 Public exploit

    Reflected XSS in CirrusSearch debug explain output

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.

    The Wikimedia Foundation Mediawiki - CirrusSearch Extension Web / CMS