High severity · published Jul 3, 2025
CVE-2025-53369
Citizen Short Description stored XSS vulnerability through wikitext
8.6
CVSS
0.3%
EPSS
No
On KEV
Description
Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
mediawiki-extensions-ShortDescription · StarCitizenTools
>= 05f6c6824f8f37dcc2d51cf6df4e7a09bea2196c, < 2c18bd21c5de53c336f55b6ff42f2983ea5796b4; >= 4.0.0, < 4.0.1 · source: vendor
Affected product
ME
mediawiki-extensions-ShortDescription
StarCitizenTools
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53369
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53369
github.com
https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/bc4fdbaeb1dff127fb6d08c0d385b64aa128c8f8
github.com
https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/security/advisories/GHSA-p85q-mww9-gwqf