CVE-2025-62663
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The UploadWizard extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.
Risk Assessment
An attacker can inject malicious scripts that execute in users' browsers, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Update the UploadWizard extension to version 1.39 or later, which contains the fix, or apply temporary measures such as input and output filtering.
Other vulnerabilities in MediaWiki UploadWizard Extension
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS