CVE-2025-62667

37th percentile - higher than 37% of all known CVEs

The GrowthExperiments extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.

An attacker can inject malicious scripts that execute in users' browsers, potentially leading to session theft, account takeover, or malware distribution.

Update the GrowthExperiments extension to version 1.39 or later, which contains the fix, or apply temporary measures such as input and output filtering.