Login Request a demo
ME
Product
Mediawiki
by Mediawiki · last CVE Jul 1, 2026
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities417In the news0Timeline
Severity mix
Critical 20High 63Medium 198Low 3
Severity
All severities417Critical20High63Medium198Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mediawiki to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2012-4379
6.5
1%
Oct 19
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an…
Affected: through 1.18.4; 1.19.0; 1.19.1
CVE-2016-6336
6.5
1%
Apr 20
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and…
Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more
CVE-2026-58518
6.3
0%
Jul 1
Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery
Affected: before 1.3.3
CVE-2026-14358
6.1
0%
Jul 1
Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4
CVE-2026-58520
6.1
0%
Jul 1
UrlShortener defaults to ineffective validation open to third-party redirects
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4
CVE-2026-58038
6.1
0%
Jul 1
Stored XSS through javascript URLs in SVGs generated by EasyTimeline
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-58030
6.1
0%
Jul 1
SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-58032
6.1
0%
Jul 1
mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-58037
6.1
0%
Jul 1
Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-34095
6.1
0%
May 11
action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request
Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2
CVE-2025-67481
6.1
0%
Feb 3
mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does
Affected: 1.39.0 before 1.39.16; 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0
CVE-2025-67483
6.1
0%
Feb 3
Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels
Affected: 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0
CVE-2025-67475
6.1
0%
Feb 3
Stored XSS through edit summaries in MW Core
Affected: 1.39.0 before 1.39.16; 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0
CVE-2025-67477
6.1
0%
Feb 3
Stored XSS through a system message in Special:ApiSandbox
Affected: 1.44.0 before 1.44.3; 1.45.0
CVE-2025-11261
6.1
0%
Feb 3
Stored i18n XSS exposed by security patch for T402077
Affected: before 1.39.15; 1.43.0 before 1.43.5; 1.44.0 before 1.44.2
CVE-2025-61645
6.1
0%
Feb 3
CodexTablePager has i18n XSS
Affected: before 1.44.1
CVE-2025-61641
6.1
0%
Feb 2
API list=allpages with maxsize is making really slow queries
Affected: before 1.39.14; 1.43.0 before 1.43.4; 1.44.0
CVE-2025-61642
6.1
0%
Feb 2
Stored XSS through system messages provided to CodexHtmlForms
Affected: before 1.39.14; 1.43.0 before 1.43.4; 1.44.0
CVE-2025-61643
6.1
0%
Feb 2
EventStreams publishes suppressed recent change entries that are suppressed from their creation
Affected: before 1.39.14; 1.43.0 before 1.43.4; 1.44.0
CVE-2024-34500
6.1
0%
May 5
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1
Affected: before 1.39.6; 1.40.0 before 1.40.2; 1.41.0 before 1.41.1
CVE-2024-23179
6.1
0%
Jan 12
An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2
Affected: before 1.40.2
CVE-2024-23177
6.1
0%
Jan 12
An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2
Affected: before 1.40.2
CVE-2024-23173
6.1
0%
Jan 12
An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2
Affected: before 1.35.14; 1.36.0 before 1.39.6; 1.40.0 before 1.40.2
CVE-2023-51704
6.1
1%
Dec 22
An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2
Affected: before 1.35.14; 1.36.0 before 1.39.6; 1.40.0 before 1.40.2
CVE-2023-45373
6.1
0%
Oct 9
An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1
Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0
CVE-2023-37302
6.1
1%
Jun 30
An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-37256
6.1
0%
Jun 29
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-37255
6.1
0%
Jun 29
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-37254
6.1
0%
Jun 29
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-37251
6.1
0%
Jun 29
An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-36675
6.1
1%
Jun 26
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4
Affected: before 1.35.11; 1.36.0 before 1.38.7; 1.39.0 before 1.39.4
CVE-2023-22911
6.1
1%
Jan 10
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1
Affected: before 1.35.9; 1.36.0 before 1.38.5; 1.39.0; 1.39.0; 1.39.0
CVE-2022-34912
6.1
1%
Jul 2
An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1
Affected: before 1.37.3; 1.38.0; 1.38.0; 1.38.0
CVE-2022-34911
6.1
1%
Jul 2
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1
Affected: before 1.35.7; 1.36.0 before 1.37.3; 1.38.0; 1.38.0; 1.38.0
CVE-2022-29907
6.1
1%
Apr 29
The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages
Affected: through 1.37.2
CVE-2022-28202
6.1
1%
Mar 30
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2
Affected: before 1.35.6; 1.36.0 before 1.36.4; 1.37.0 before 1.37.2
CVE-2021-45474
6.1
1%
Dec 24
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter
Affected: through 1.37
CVE-2021-45473
6.1
1%
Dec 24
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar)
Affected: through 1.3.7
CVE-2021-45472
6.1
1%
Dec 24
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the…
Affected: through 1.37
CVE-2021-41798
6.1
1%
Oct 11
MediaWiki before 1.36.2 allows XSS
Affected: before 1.36.2
CVE-2021-42043
6.1
1%
Oct 6
An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2
Affected: through 1.36.2
CVE-2021-42041
6.1
1%
Oct 6
An issue was discovered in CentralAuth in MediaWiki through 1.36.2
Affected: through 1.36.2
CVE-2021-42046
6.1
1%
Oct 6
An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2
Affected: through 1.36.2
CVE-2021-31551
6.1
1%
Apr 22
An issue was discovered in the PageForms extension for MediaWiki through 1.35.2
Affected: through 1.35.2
CVE-2021-30157
6.1
1%
Apr 6
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2
Affected: before 1.31.12; 1.32.0 before 1.35.2
CVE-2021-30154
6.1
1%
Apr 6
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2
Affected: before 1.31.12; 1.32.0 before 1.35.2
CVE-2020-35622
6.1
1%
Dec 21
An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1
Affected: through 1.35.1
CVE-2020-35479
6.1
1%
Dec 18
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php
Affected: 1.12.0 before 1.35.1
CVE-2020-35478
6.1
1%
Dec 18
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php
Affected: 1.33.0 before 1.35.1
CVE-2020-35474
6.1
1%
Dec 18
In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be…
Affected: before 1.35.1
Page 3 of 9 · 417 total
1234…9