Skip to content
OpenAdvisories
Low · 1.1 CVE-2025-61650 EUVD-2025-206642

UserInfoCard is vulnerable to message key stored XSS

Published Feb 3, 2026 · Updated Feb 3, 2026 · Assigned by wikimedia-foundation

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php.

This issue affects CheckUser: from * before 795bf333272206a0189050d975e94b70eb7dc507.

Affected products

VendorProductAffectedFixed
Wikimedia Foundation CheckUser < 795bf333272206a0189050d975e94b70eb7dc507 795bf333272206a0189050d975e94b70eb7dc507

References