CVE-2025-21612

CVE-2025-21612 affects the MediaWiki extension TabberNeue. The vulnerability arises because TabberTransclude.php did not escape the user-supplied page name when outputting, enabling a Cross-site Scripting (XSS) payload to be injected as the page name. It is fixed in version 2.7.2. Connected sourc...