CVE-2025-62702

MediumCVSS 6.9

Published: 21/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

The PageTriage extension in MediaWiki contains a Stored XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions from master before 1.44.

Risk Assessment

An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft, account takeover, or malware propagation.

Recommendation

Update the PageTriage extension to version 1.44 or later, which includes a fix for the XSS vulnerability.

Other vulnerabilities in MediaWiki PageTriage Extension

CVE-2026-103440Low
Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS