CVE-2025-62508

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s...

CVE-2025-62508: Improper Neutralization of Input During Web Page Generation

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s...

PT-2025-42653

Name of the Vulnerable Software and Affected Versions Citizen versions 3.3.0 through 3.9.0 Description Citizen, a MediaWiki skin, has an issue where stored cross-site scripting can occur in the sticky header button message handling. The copyButtonAttributes function in stickyHeader.js assigns...