CVE-2025-7363

The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the titleiconunicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript...

CVE-2025-7363

creationtimestamp| type| source ---|---|--- 2025-07-10 14:18:58+00:00| seen| Telegram/Oe0qoM8hEMHoP1XQ7W6-oqiMP31ASNvAnpa3YbmrnDuYpio...

CVE-2025-7363

The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the titleiconunicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript...

CVE-2025-7363

The MediaWiki TitleIcon extension is vulnerable to stored Cross-Site Scripting (XSS) due to the #titleicon_unicode parser function. The root cause is that user input passed to this function is wrapped in an HtmlArmor object without proper sanitization before being rendered directly into the page ...