Skip to content
OpenAdvisories

Vendor

Wikimedia Foundation

153 known vulnerabilities.

Products

MediaWiki 55 CheckUser 9 Mediawiki - Cargo Extension 4 Mediawiki - AbuseFilter Extension 3 Mediawiki - SecurePoll extension 3 AbuseFilter 3 Mediawiki - CheckUser extension 3 Mediawiki - DataTransfer Extension 2 OATHAuth 2 Vector 2 Mediawiki - Wikibase Extension 2 Scribunto 2 Mediawiki - MintyDocs Extension 2 VisualEditor 2 Mediawiki - IPInfo Extension 2 Parsoid 2 MediaWiki - CampaignEvents extension 2 Mediawiki - TemplateSandbox Extension 2 timeline 2 MediaWiki - ProofreadPage Extension 2 Mediawiki - CentralAuth Extension 2 Mediawiki - UploadWizard Extension 2 Mediawiki - WikiLambda Extension 2 Mediawiki - ExternalData Extension 1 Echo 1 Mediawiki - Flow Extension 1 Mediawiki - ArticleFeedbackv5 extension 1 mediawiki-extensions-I18nTags 1 Wikipedia Android App 1 Mediawiki - UrlShortener Extension 1 MultimediaViewer 1 Mediawiki - SocialProfile Extension 1 Mediawiki - RelatedArticles Extension 1 OAuth 1 Mediawiki - Scribunto Extension 1 Mediawiki - ApprovedRevs extension 1 MediaWiki - VisualData Extension 1 UrlShortener 1 Mediawiki - MassEditRegex Extension 1 Mediawiki - GoogleDocs4MW Extension 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.5
    CVE-2026-102796

    Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: from * bef…

    Wikimedia Foundation Mediawiki - UserPageViewTracker Extension Web / CMS
  • High 7.5
    CVE-2026-100244

    CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.

    Wikimedia Foundation Mediawiki - CentralAuth Extension Web / CMS
  • High 7.5
    CVE-2026-100242

    DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

    Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 befor…

    Wikimedia Foundation Mediawiki - DataTransfer Extension Web / CMS
  • High 7.5
    CVE-2026-100241

    Private change tags exposed to anonymous users via revision-tags-change events

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.

    Wikimedia Foundation Mediawiki - EventBus Extension Web / CMS
  • High 7.5
    CVE-2026-0669

    Path Traversal vulnerability in CSS extension on certain web servers

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

    Wikimedia Foundation MediaWiki - CSS extension Web / CMS
  • High 7.5
    CVE-2025-53485

    SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes

    SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue af…

    Wikimedia Foundation Mediawiki - SecurePoll extension Web / CMS
  • High 8.8
    CVE-2025-53483

    SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery

    ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site. This issue affects Mediawiki - SecurePoll extensio…

    Wikimedia Foundation Mediawiki - SecurePoll extension Web / CMS
  • High 7.5
    CVE-2025-53481

    Denial of service vector on ipinfo/v0/norevision

    Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

    Wikimedia Foundation Mediawiki - IPInfo Extension Web / CMS
  • High 8.8
    CVE-2025-6926

    Security Authentication Bypass in CentralAuth

    Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43…

    Wikimedia Foundation Mediawiki - CentralAuth Extension mediawiki mediawiki Web / CMS Debian Ubuntu
  • High 8.8
    CVE-2025-53501

    Content Access Bypass in Scribunto

    Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki - Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.…

    Wikimedia Foundation Mediawiki - Scribunto Extension Web / CMS