CVE-2025-21612 Cross-site Scripting in TabberTransclude in Extension:TabberNeue

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2...

CVE-2025-21612

CVE-2025-21612 affects the MediaWiki extension TabberNeue. The vulnerability arises because TabberTransclude.php did not escape the user-supplied page name when outputting, enabling a Cross-site Scripting (XSS) payload to be injected as the page name. It is fixed in version 2.7.2. Connected sourc...

PT-2025-4300 · Unknown · Tabberneue

Name of the Vulnerable Software and Affected Versions: TabberNeue versions prior to 2.7.2 Description: The issue arises from unescaped user input being used to construct HTML, allowing any user who can edit pages or render wikitext to perform cross-site scripting XSS attacks on other users...