Skip to content
OpenAdvisories
Medium · 6.9 CVE-2025-11937 EUVD-2025-34968GHSA-f598-qv9r-92cj

Stored XSS through a system message in SecurePoll

Published Oct 18, 2025 · Updated Oct 20, 2025 · Assigned by wikimedia-foundation

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.

Affected products

VendorProductAffectedFixed
The Wikimedia Foundation Mediawiki - SecurePoll Extension master —

Advisories 1

References