Security Advisory

CVE-2025-53479

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-07-08 17:16:36

Last updated 2025-07-10 13:18:39

Assigner wikimedia-foundation

CVSS score not scored

State PUBLISHED

Description

The CheckUser extension’s Special:CheckUser interface is vulnerable to reflected XSS via the rev-deleted-user message. This message is rendered without proper escaping, making it possible to inject JavaScript through the uselang=x-xss language override mechanism. This issue affects Mediawiki - CheckUser extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

← Browse all CVEs View on cve.org ↗