Vulnerability · Published Apr 11, 2025 · Assigned by wikimedia-foundation
CVE-2025-32069Wikitext stored XSS on filepages due to dangerous WBMI serialization
Medium 5.4
In plain English
A medium-severity improper input validation in Mediawiki - Wikibase Media Info Extension from The Wikimedia Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 85.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Wikimedia Foundation | Mediawiki - Wikibase Media Info Extension | 1.39 – through 1.43 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N