Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php.
This issue affects MediaWiki: >= 1.42.0.
CVE-2025-6590 is a medium-severity vulnerability in Wikimedia Foundation's MediaWiki software that leads to exposure of sensitive information to unauthorized actors. It affects all versions up to 1.39.12, 1.42.76, 1.43.1, and 1.44.0, specifically involving the HTMLUserTextField.
Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php.
This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php.
This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php.
This issue affects MediaWiki: from >= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43.
Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GrowthExperiments Extension: 1.45, 1.44, 1.43, 1.39.
CVE-2026-22714 is a Cross-Site Scripting (XSS) vulnerability found in the Monaco Skin of Mediawiki versions 1.39, 1.43, 1.44, and 1.45 maintained by The Wikimedia Foundation. This vulnerability arises due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The CVSS 4.0 score is 2.3, indicating a low severity level, primarily because exploitation requires user interaction and only impacts confidentiality and integrity to a limited extent. No known exploits are currently reported in the wild.
CVE-2026-22710 is a Cross-Site Scripting (XSS) vulnerability in the Mediawiki Wikibase Extension versions 1.39, 1.43, 1.44, and 1.45. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability has a low CVSS score of 2.3, indicating limited impact and requiring user interaction without authentication. No known exploits are currently reported in the wild. European organizations using affected Mediawiki versions with the Wikibase Extension could face risks of session hijacking or content manipulation if exploited.
CVE-2026-0670 is a medium severity Cross-Site Scripting (XSS) vulnerability in the ProofreadPage extension of Wikimedia Foundation's MediaWiki software versions 1.39, 1.43, 1.44, and 1.45. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of users' browsers. Exploitation requires user interaction but no authentication, and can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. No known exploits are currently in the wild, and no patches have been linked yet. European organizations using MediaWiki with the ProofreadPage extension, especially those involved in collaborative documentation or digital libraries, should be aware of this risk. Mitigation involves applying patches when available, sanitizing user inputs, and employing Content Security Policies.
CVE-2026-0669 is a high-severity path traversal vulnerability in the CSS extension of Wikimedia Foundation's MediaWiki versions 1.39, 1.43, and 1.44. This flaw allows an unauthenticated remote attacker to read arbitrary files on the server by manipulating file path inputs, bypassing directory restrictions. The vulnerability impacts confidentiality but does not affect integrity or availability. No user interaction or privileges are required for exploitation, and no known exploits are currently reported in the wild. European organizations using affected MediaWiki versions, especially those hosting sensitive or proprietary information, face significant data exposure risks. Mitigation requires promptly updating to patched versions once available or applying strict input validation and access controls on the CSS extension. Countries with high MediaWiki adoption in government, education, and public sectors—such as Germany, France, the UK, and the Netherlands—are most at risk.
CVE-2026-0668 is a medium-severity vulnerability in the Wikimedia Foundation's MediaWiki VisualData Extension version 1.45. It involves inefficient regular expression complexity, leading to a potential Regular Expression Denial of Service (ReDoS) attack. This vulnerability can be exploited remotely without authentication or user interaction, causing service disruption by exhausting server resources. No known exploits are currently reported in the wild. The impact is limited to availability, with no confidentiality or integrity compromise. European organizations running affected MediaWiki versions with the VisualData extension are at risk of service degradation or downtime. Mitigation requires patching or applying workarounds to limit or optimize regex processing. Countries with significant Wikimedia usage and MediaWiki deployments, such as Germany, France, and the UK, are most likely affected. The vulnerability's CVSS score is 5.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki CookieConsent extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki CookieConsent extension: from v0.1.0 before v2.0.0.
Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.
Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44.
