Medium severity · published Oct 18, 2025
CVE-2025-62667
Stored XSS through article extracts in GrowthExperiments
6.9
CVSS
0.4%
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MG
Mediawiki - GrowthExperiments Extension · The Wikimedia Foundation
master before 1.39 · source: vendor
Affected product
MG
Mediawiki - GrowthExperiments Extension
The Wikimedia Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62667
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62667
gerrit.wikimedia.org
https://gerrit.wikimedia.org/r/q/Iafd0acccf9a5c20d9e955d7bc3de1304968401ec
phabricator.wikimedia.org
https://phabricator.wikimedia.org/T402698
More from Mediawiki - GrowthExperiments Extension
6.9
CVE-2026-39934
Growth Experiments ReassignMenteesJob runs as an infinite loop
6.9
CVE-2025-62668
Insufficient permission checks in action=growthsetmentor
5.4
CVE-2026-22713
Stored XSS through edit summaries in GrowthExperiments