Skip to content
OpenAdvisories

Vendor

Wikimedia Foundation

153 known vulnerabilities.

Products

MediaWiki 55 CheckUser 9 Mediawiki - Cargo Extension 4 Mediawiki - AbuseFilter Extension 3 Mediawiki - SecurePoll extension 3 AbuseFilter 3 Mediawiki - CheckUser extension 3 Mediawiki - DataTransfer Extension 2 OATHAuth 2 Vector 2 Mediawiki - Wikibase Extension 2 Scribunto 2 Mediawiki - MintyDocs Extension 2 VisualEditor 2 Mediawiki - IPInfo Extension 2 Parsoid 2 MediaWiki - CampaignEvents extension 2 Mediawiki - TemplateSandbox Extension 2 timeline 2 MediaWiki - ProofreadPage Extension 2 Mediawiki - CentralAuth Extension 2 Mediawiki - UploadWizard Extension 2 Mediawiki - WikiLambda Extension 2 Mediawiki - ExternalData Extension 1 Echo 1 Mediawiki - Flow Extension 1 Mediawiki - ArticleFeedbackv5 extension 1 mediawiki-extensions-I18nTags 1 Wikipedia Android App 1 Mediawiki - UrlShortener Extension 1 MultimediaViewer 1 Mediawiki - SocialProfile Extension 1 Mediawiki - RelatedArticles Extension 1 OAuth 1 Mediawiki - Scribunto Extension 1 Mediawiki - ApprovedRevs extension 1 MediaWiki - VisualData Extension 1 UrlShortener 1 Mediawiki - MassEditRegex Extension 1 Mediawiki - GoogleDocs4MW Extension 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-100240

    TemplateSandbox does not check read permissions for the page being previewed

    Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

    Wikimedia Foundation Mediawiki - TemplateSandbox Extension Web / CMS
  • Critical 10.0
    CVE-2026-100382 Public exploit

    Unauthenticated remote code execution through wikitext in ExternalData

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * befo…

    Wikimedia Foundation Mediawiki - ExternalData Extension Web / CMS
  • Critical 9.1
    CVE-2025-53499

    Unauthorized Inspection of Protected Variables in AbuseFilter

    Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.

    Wikimedia Foundation Mediawiki - AbuseFilter Extension Web / CMS
  • Critical 9.1
    CVE-2025-53495

    Unauthorized Disclosure of IP Reputation in AbuseFilter

    Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.

    Wikimedia Foundation Mediawiki - AbuseFilter Extension Web / CMS
  • Critical 9.8
    CVE-2025-53484

    SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped input

    User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions…

    Wikimedia Foundation Mediawiki - SecurePoll extension Web / CMS