Wikimedia

By the Year

In 2026 there have been 105 vulnerabilities in Wikimedia with an average score of 5.7 out of ten. Last year, in 2025 Wikimedia had 23 security vulnerabilities published. That is, 82 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.60

Recent Wikimedia Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-14363	Jul 01, 2026	SQL Injection in MediaWiki Cargo Extension <1.45.4 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.	Mediawiki
CVE-2026-14358	Jul 01, 2026	MediaWiki Charts XSS before 1.43.9/1.44.6/1.45.4 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.	Mediawiki
CVE-2026-58517	Jul 01, 2026	MediaWiki WikiLambda Auth Bypass before 1.45.4 Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.	Mediawiki
CVE-2026-58521	Jul 01, 2026	MediaWiki Cargo Extension SQLi before v1.45.4 (MediaWiki 1.43.9, 1.44.6, 1.45.4) Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.	Mediawiki
CVE-2026-58520	Jul 01, 2026	MediaWiki UrlShortener Ext <=1.45.4 open redirect URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.	Mediawiki
CVE-2026-58025	Jul 01, 2026	MediaWiki <1.46.0 Deserialization of Untrusted Data Vulnerability Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.	Mediawiki
CVE-2026-58029	Jul 01, 2026	MediaWiki API AuthData Bypass before 1.46.0 (link/remove unlink) Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.	Mediawiki
CVE-2026-58028	Jul 01, 2026	MediaWiki/CentralAuth XSS in ApiFormatBase.Php before 1.46.0 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.	Mediawiki
CVE-2026-58026	Jul 01, 2026	MediaWiki 1.46 Sensitive Data Leak via Parser.Php Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.	Mediawiki
CVE-2026-8857	Jul 01, 2026	Wikimedia EasyTimeline <=1.46.0 Vulnerable via Timeline.Php A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVE-2026-58038	Jul 01, 2026	XSS in Wikimedia Timeline before 1.46.0 (Timeline.Php) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVE-2026-58027	Jul 01, 2026	Sensitive Info Leakage in AbuseFilter <1.46.0 (PHP) Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVE-2026-58030	Jul 01, 2026	Wikimedia SyntaxHighlight_GeSHi XSS in SyntaxHighlight.Php (<1.46.0) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVE-2026-58032	Jul 01, 2026	XSS in MediaWiki index.Js API before 1.46.0 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.	Mediawiki
CVE-2026-58033	Jul 01, 2026	MediaWiki Sensitive Info Leak via InfoAction before 1.46.0 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.	Mediawiki
CVE-2026-58037	Jul 01, 2026	MediaWiki XSS via Language.Php (v<1.46.0) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.	Mediawiki
CVE-2026-58036	Jul 01, 2026	MediaWiki API User Queries Info Disclosure via PermissionManager Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.	Mediawiki
CVE-2026-58024	Jul 01, 2026	MediaWiki Unauthorized Data Leak via ApiUserrights.php <1.46 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.	Mediawiki
CVE-2026-13707	Jul 01, 2026	Session Fixation in Wikimedia OAuth before v1.46.0 (MWOAuthServer.Php) Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVE-2026-13706	Jul 01, 2026	Wikimedia UrlShortener Improper Input Validation (PHP) Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.
CVE-2026-58031	Jul 01, 2026	MediaWiki XSS in ApiSandboxLayout.Js pre-1.46.0 (before 1.46.0-rc.0) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.	Mediawiki
CVE-2026-58034	Jul 01, 2026	Wikimedia CheckUser XSS via blockConnectedTempAccountsField.Vue (before 1.46.0) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.
CVE-2026-58035	Jul 01, 2026	MediaWiki XSS via Special.Block SpecialBlock.Vue Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.	Mediawiki
CVE-2026-58519	Jul 01, 2026	Stored XSS in MediaWiki Cargo Ext before 3.9.1 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.	Mediawiki
CVE-2026-58518	Jul 01, 2026	Mediawiki RedirectManager 1.3.3 CSRF Vulnerability Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3.	Mediawiki
CVE-2026-5266	May 11, 2026	Echo before 1.45.2 Info Exposure via ApiEchoNotifications.PHP Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34095	May 11, 2026	MediaWiki (<1.43.7/1.44.4/1.45.2) DirTrv in ActionEntryPoint.php Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.	Mediawiki
CVE-2026-34094	May 11, 2026	MediaWiki 1.43/1.44/1.45 PHP Article File RCE Before 1.43.7, 1.44.4, 1.45.2 Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.	Mediawiki
CVE-2026-34093	May 11, 2026	Sensitive Info Leak via SpecialUserRights (up to 1.45.2) Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.	Mediawiki
CVE-2026-34092	May 11, 2026	MediaWiki PHP Skin Exposure (<=1.43.7/1.44.4/1.45.2) Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.	Mediawiki
CVE-2026-34091	May 11, 2026	MediaWiki <1.43.7/1.44.4/1.45.2: SigInfo Disclosure to UNAuth Actors Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.	Mediawiki
CVE-2026-34090	May 11, 2026	Unauthorized Sensitive Info Disclosure in CheckUser < 1.45.2 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2.
CVE-2026-34089	May 11, 2026	Scribunto 1.45.01.45.1 Vulnerability (fixed 1.45.2) Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.
CVE-2026-34088	May 11, 2026	MediaWiki <1.43.7/1.44.4/1.45.2 Sensitive Information Leak Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.	Mediawiki
CVE-2026-34087	May 11, 2026	Sensitive Info Exposure in Wikimedia OATHAuth pre-1.45.2 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34086	May 11, 2026	Vulnerability in Wiki AbuseFilter (before 1.43.7/1.44.4/1.45.2) Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-39936	Apr 07, 2026	MediaWiki Score Extension: XSS via Improper Input Neutralization Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.	Mediawiki
CVE-2026-39935	Apr 07, 2026	MediaWiki CampaignEvents XSS <=1.45.2 (Before 1.45.3) Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.	Mediawiki
CVE-2026-39934	Apr 07, 2026	MediaWiki GrowthExperiments Ext 1.45.2/1.44.4/1.43.7 Infinite Loop via TOCTOU Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue was remediated only on the `master` branch.	Mediawiki
CVE-2026-39933	Apr 07, 2026	XSS in MediaWiki GlobalWatchlist Ext Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.	Mediawiki
CVE-2026-39937	Apr 07, 2026	MediaWiki CentralAuth SLY: Sensitive Data Leak via Improper Info Removal Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.	Mediawiki
CVE-2026-39837	Apr 07, 2026	MediaWiki Cargo 3.8.7 Stored XSS via Script Tag Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.	Mediawiki
CVE-2026-39841	Apr 07, 2026	Mediawiki CargoExt <3.8.7: Stored XSS via Script-Rel HTML Tags Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.	Mediawiki
CVE-2026-39840	Apr 07, 2026	Mediawiki Cargo Ext XSS before 3.8.7 Target Non-Script Elements Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.	Mediawiki
CVE-2026-39839	Apr 07, 2026	Mediawiki Cargo Ext Before 3.8.7: Stored XSS via Script Tags Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.	Mediawiki
CVE-2026-39838	Apr 07, 2026	MediaWiki ProofreadPage XSS via NonScript Element Injection Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.	Mediawiki
CVE-2026-5762	Apr 07, 2026	DoS via unchecked resource allocation in MediaWiki ReportInc Ext 1.43.7-1.45.2 Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS. This issue was remediated only on the `master` branch.	Mediawiki
CVE-2026-22711	Apr 07, 2026	MediaWiki - Wikilove Ext XSS via alt syntax 1.43.71.45.2 Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.	Mediawiki
CVE-2025-67481	Feb 03, 2026	MediaWiki XSS via mediawiki.JqueryMsg.Js before 1.45.1 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.	Mediawiki
CVE-2025-67482	Feb 03, 2026	Wikimedia Scribunto <1.39.16: Lua sandbox RCE Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a.