Skip to content
OpenAdvisories

Vendor

Wikimedia Foundation

153 known vulnerabilities.

Products

MediaWiki 55 CheckUser 9 Mediawiki - Cargo Extension 4 Mediawiki - AbuseFilter Extension 3 Mediawiki - SecurePoll extension 3 AbuseFilter 3 Mediawiki - CheckUser extension 3 Mediawiki - DataTransfer Extension 2 OATHAuth 2 Vector 2 Mediawiki - Wikibase Extension 2 Scribunto 2 Mediawiki - MintyDocs Extension 2 VisualEditor 2 Mediawiki - IPInfo Extension 2 Parsoid 2 MediaWiki - CampaignEvents extension 2 Mediawiki - TemplateSandbox Extension 2 timeline 2 MediaWiki - ProofreadPage Extension 2 Mediawiki - CentralAuth Extension 2 Mediawiki - UploadWizard Extension 2 Mediawiki - WikiLambda Extension 2 Mediawiki - ExternalData Extension 1 Echo 1 Mediawiki - Flow Extension 1 Mediawiki - ArticleFeedbackv5 extension 1 mediawiki-extensions-I18nTags 1 Wikipedia Android App 1 Mediawiki - UrlShortener Extension 1 MultimediaViewer 1 Mediawiki - SocialProfile Extension 1 Mediawiki - RelatedArticles Extension 1 OAuth 1 Mediawiki - Scribunto Extension 1 Mediawiki - ApprovedRevs extension 1 MediaWiki - VisualData Extension 1 UrlShortener 1 Mediawiki - MassEditRegex Extension 1 Mediawiki - GoogleDocs4MW Extension 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-100382 Public exploit

    Unauthenticated remote code execution through wikitext in ExternalData

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * befo…

    Wikimedia Foundation Mediawiki - ExternalData Extension Web / CMS
  • Medium 5.3
    CVE-2026-100381 Public exploit

    UploadWizard Flickr collection and set titles allow DOM XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from…

    Wikimedia Foundation Mediawiki - UploadWizard Extension Web / CMS
  • Medium 5.3
    CVE-2026-100380 Public exploit

    Reflected XSS in Wikibase Special:SetLabel language validation

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * befor…

    Wikimedia Foundation Mediawiki - Wikibase Extension Web / CMS
  • Medium 5.9
    CVE-2026-58025 Public exploit

    Remote Code Execution via Unsafe Deserialization in LogItem Import

    Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects Me…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-61638 Public exploit

    Sanitizer::validateAttributes data-XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/C…

    Wikimedia Foundation MediaWiki Parsoid mediawiki Web / CMS Debian Ubuntu