Medium severity · published Jul 3, 2025
CVE-2025-53370
Citizen stored XSS vulnerability through short descriptions
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
mediawiki-skins-Citizen · StarCitizenTools
>= 65a7ffd927467c8c3557146d1ac6de62b0369b6c, < c85a40bddc8651fff66df83a72debddcb34f0521; >= 1.9.4, < 3.4.0 · source: vendor
CI
Citizen · Starcitizen.tools
1.9.4 before 3.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53370
Patch
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/c85a40bddc8651fff66df83a72debddcb34f0521
Release Notes
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0
Exploit
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-prmv-7r8c-794g
More from mediawiki-skins-Citizen
6.5
CVE-2025-62508
Citizen vulnerable to stored XSS in sticky header button messages
5.4
CVE-2025-53368
Citizen is vulnerable to stored XSS attack in the legacy search bar
5.4
CVE-2025-49576
Citizen allows stored XSS in search no result messages
5.4
CVE-2025-49578
Citizen allows stored XSS in user registration date message
5.4
CVE-2025-49575
Citizen allows stored XSS in Command Palette tip messages