CVE-2020-27620

The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups...

CVE-2020-27620

The CVE-2020-27620 issue affects MediaWiki Cosmos Skin up to 1.35.0, which is vulnerable to stored XSS due to improper escaping of MediaWiki messages (wfMessage and Html::rawElement), as demonstrated by CosmosSocialProfile::getUserGroups. Connected documents confirm the vulnerability and its root...