Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Wikimedia Foundation — Vulnerabilities & Security Advisories 152

Browse all 152 CVE security advisories affecting Wikimedia Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Wikimedia Foundation operates the world’s largest collaborative encyclopedia platform, hosting Wikipedia and related projects that serve billions of monthly visitors. Its infrastructure relies on complex software stacks, including MediaWiki, which has historically been susceptible to various vulnerability classes. Common issues include cross-site scripting (XSS), SQL injection, and remote code execution (RCE) stemming from legacy code paths or misconfigurations. While the organization maintains a robust security posture with regular audits and bug bounty programs, the sheer scale of its codebase and the open nature of its editing model present unique challenges. Recent years have seen efforts to mitigate privilege escalation risks and improve input validation. Despite these ongoing technical hurdles, the Foundation remains a critical public resource, balancing transparency with the need to protect user data and system integrity against sophisticated cyber threats targeting its extensive digital footprint.

Top products by Wikimedia Foundation: MediaWiki CheckUser Mediawiki - Cargo Extension Mediawiki - AbuseFilter Extension Mediawiki - CheckUser extension Mediawiki - SecurePoll extension AbuseFilter Mediawiki - TemplateSandbox Extension VisualEditor Scribunto timeline OATHAuth Mediawiki - MintyDocs Extension Mediawiki - CampaignEvents Extension Mediawiki - WikiLambda Extension Vector Mediawiki - Wikibase Extension Mediawiki - IPInfo Extension MediaWiki - ProofreadPage Extension MediaWiki - UploadWizard extension Mediawiki - CentralAuth Extension Mediawiki - DataTransfer Extension Wikipedia Android App Mediawiki - EventBus Extension SyntaxHighlight_GeSHi Mediawiki - Flow Extension Thanks TextExtracts DiscussionTools ConfirmEdit
CVE ID Title CVSS Severity Published
CVE-2026-102796 Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters — Mediawiki - UserPageViewTracker Extension CWE-89 - - 2026-09-29
CVE-2026-100245 Stored XSS on Wikibase Special:SetSiteLink via unescaped system message — Mediawiki - Wikibase Extension CWE-79 - - 2026-09-29
CVE-2026-100244 CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669) — Mediawiki - CentralAuth Extension CWE-200 - - 2026-09-29
CVE-2026-100243 Stored XSS in WikiSEO author and image properties on action=info — Mediawiki - WikiSEO Extension CWE-79 - - 2026-09-29
CVE-2026-100242 DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) — Mediawiki - DataTransfer Extension CWE-1395 - - 2026-09-29
CVE-2026-100241 Private change tags exposed to anonymous users via revision-tags-change events — Mediawiki - EventBus Extension CWE-200 - - 2026-09-29
CVE-2026-100240 TemplateSandbox does not check read permissions for the page being previewed — Mediawiki - TemplateSandbox Extension CWE-862 - - 2026-09-29
CVE-2026-100238 Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS — Mediawiki - Flow Extension CWE-79 - - 2026-09-29
CVE-2026-100383 Stored i18n XSS in WikiLambda's VisualEditor integration — Mediawiki - WikiLambda Extension CWE-79 4.8 Medium 2026-09-25
CVE-2026-100382 Unauthenticated remote code execution through wikitext in ExternalData — Mediawiki - ExternalData Extension CWE-78 10.0 Critical 2026-09-25
CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS — Mediawiki - UploadWizard Extension CWE-79 5.3 Medium 2026-09-25
CVE-2026-100380 Reflected XSS in Wikibase Special:SetLabel language validation — Mediawiki - Wikibase Extension CWE-79 5.3 Medium 2026-09-25
CVE-2026-100379 Cross-request disclosure of CentralAuth cookies in Wikipedia Android App — Wikipedia Android App CWE-200 5.3 Medium 2026-09-25
CVE-2026-100378 Missing permission check in the Translate sandbox doRemind action — Mediawiki - Translate Extension CWE-862 5.3 Medium 2026-09-25
CVE-2026-100376 TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix — Mediawiki - TemplateSandbox Extension CWE-79 4.8 Medium 2026-09-25
CVE-2026-100377 Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract — Mediawiki - WikiLambda Extension CWE-200 6.9 Medium 2026-09-25
CVE-2026-58025 Remote Code Execution via Unsafe Deserialization in LogItem Import — MediaWiki CWE-502 - - 2026-07-01
CVE-2026-58029 Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata — MediaWiki - - 2026-07-01
CVE-2026-58028 Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets — MediaWiki CWE-79 - - 2026-07-01
CVE-2026-58026 $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces — MediaWiki CWE-200 - - 2026-07-01
CVE-2026-8857 Full RCE using EasyTimeline Extension — timeline CWE-94 - - 2026-07-01
CVE-2026-58038 Stored XSS through javascript URLs in SVGs generated by EasyTimeline — timeline CWE-79 - - 2026-07-01
CVE-2026-58027 QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI — AbuseFilter CWE-200 - - 2026-07-01
CVE-2026-58030 SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute — SyntaxHighlight_GeSHi CWE-79 - - 2026-07-01
CVE-2026-58032 mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html — MediaWiki CWE-79 - - 2026-07-01
CVE-2026-58033 "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted — MediaWiki CWE-200 - - 2026-07-01
CVE-2026-58037 Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input — MediaWiki CWE-79 - - 2026-07-01
CVE-2026-58036 Users API leaks whether privileged users have their user groups disabled for lack of 2FA — MediaWiki CWE-200 - - 2026-07-01
CVE-2026-58024 API identification of users on private wikis — MediaWiki CWE-200 - - 2026-07-01
CVE-2026-13707 Session fixation attacks on improperly configured OAuth 1.0a tools — OAuth CWE-384 - - 2026-07-01

This page lists every published CVE security advisory associated with Wikimedia Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.