Vulnerability · Published Oct 20, 2025 · Assigned by wikimedia-foundation
CVE-2025-62657Stored XSS through system messages in PageForms
Medium 5.8
In plain English
A medium-severity cross-site scripting in MediaWiki PageForms extension from The Wikimedia Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 4.0)5.8Medium
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.This issue affects MediaWiki PageForms extension: 1.44.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:25.10 | mediawiki | no fix listed | UBUNTU-CVE-2025-62657 |
| Ubuntu:26.04:LTS | mediawiki | no fix listed | UBUNTU-CVE-2025-62657 |
| Ubuntu:26.10 | mediawiki | no fix listed | UBUNTU-CVE-2025-62657 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Wikimedia Foundation | MediaWiki PageForms extension | 1.44 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:C/RE:L/U:Amber