CVE-2025-62694

MediumCVSS 6.9

Published: 21/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

40th percentile - higher than 40% of all known CVEs

Summary

The MediaWiki - WikiLove extension contains a stored XSS vulnerability due to improper input neutralization during web page generation. The vulnerability affects version 1.39 of the extension.

Risk Assessment

An attacker can inject malicious scripts that execute in the user's browser, potentially leading to session theft, account takeover, or the spread of malicious content within the wiki.

Recommendation

Immediately update the MediaWiki - WikiLove extension to a patched version that fixes the XSS vulnerability. Also consider implementing Content Security Policy (CSP) to mitigate the impact of such attacks.

Other vulnerabilities in MediaWiki - WikiLove extension

CVE-2026-22711Medium
Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS