Log in Start free

Vulnerability · Published Jun 27, 2025 · Assigned by GitHub_M

CVE-2025-53093TabberNeue vulnerable to Stored XSS through wikitext

High 8.6

In plain English

A high-severity cross-site scripting in mediawiki-extensions-TabberNeue from StarCitizenTools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.4%top 63.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagiststarcitizentools/tabber-neue3.1.1GHSA-jfj7-249r-7j2m

Affected products (as reported)

VendorProductVersions
StarCitizenTools mediawiki-extensions-TabberNeue >= 3.0.0, < 3.1.1

Weakness: CWE-79, CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References