Vulnerability · Published Apr 24, 2025 · Assigned by GitHub_M

CVE-2025-43861ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection

Medium 4.4

In plain English

A medium-severity cross-site scripting in ManageWiki from miraheze. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review dialog. A logged-in attacker must change a form field to include a malicious payload. If that same user then opens the "Review Changes" dialog, the payload will be rendered and executed in the context of their own session. This issue has been patched in commit 2f177dc.

Affected products (as reported)

Vendor	Product	Versions
miraheze	ManageWiki	< 2f177dc

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/miraheze/ManageWiki/security/advisories/GHSA-859x-46h8-vcrv x_refsource_CONFIRM
https://github.com/miraheze/ManageWiki/commit/2f177dc83b28b727613215b835d4036cb179e4ab x_refsource_MISC