CVE-2025-53478

The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages rendered on the “IPs and User agents” tab. This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X befor...

CVE-2025-53478 CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messages

The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages rendered on the “IPs and User agents” tab. This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X befor...

CVE-2025-53478

The CVE-2025-53478 issue affects the MediaWiki CheckUser extension, specifically the Special:Investigate interface. It is a reflected XSS flaw caused by improper escaping of internationalized system messages rendered on the “IPs and User agents” tab. Affected versions include 1.39.x before 1.39.1...

CVE-2025-53478 CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messages

The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages rendered on the “IPs and User agents” tab. This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X befor...

CVE-2025-53486

The WikiCategoryTagCloud extension is vulnerable to reflected XSS via the linkstyle attribute, which is improperly concatenated into inline HTML without escaping. An attacker can inject JavaScript event handlers such as onmouseenter using carefully crafted input via the tag:tagcloud parser...

CVE-2025-53486

CVE-2025-53486 affects MediaWiki WikiCategoryTagCloud extension via reflected XSS in the linkstyle attribute. The issue arises because the value is passed through Sanitizer::checkCss() (which does not escape HTML) and concatenated into a style attribute instead of using proper HTML element creati...

CVE-2024-43334

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gavias Zilom zilom allows Reflected XSS.This issue affects Zilom: from n/a through 1.4.5...

CVE-2024-43334

CVE-2024-43334 affects Gavias Halpes WordPress theme (and Halpes plugin-facing context) with a Reflected XSS due to improper input neutralization in web page generation. Affected versions are prior to 1.2.5; the issue enables attacker-controlled input to be reflected in output, potentially tamper...

PT-2025-28177 · Mediawiki · Mediawiki - Wikicategorytagcloud Extension

Name of the Vulnerable Software and Affected Versions: MediaWiki WikiCategoryTagCloud extension versions 1.39.X through 1.39.12 MediaWiki WikiCategoryTagCloud extension versions 1.42.X through 1.42.6 MediaWiki WikiCategoryTagCloud extension versions 1.43.X through 1.43.1 Description: The...

PT-2025-28243 · Mediawiki · Mediawiki

Name of the Vulnerable Software and Affected Versions: Mediawiki - CheckUser extension versions 1.39.0 through 1.39.12 Mediawiki - CheckUser extension versions 1.42.0 through 1.42.6 Mediawiki - CheckUser extension versions 1.43.0 through 1.43.1 Description: The CheckUser extension’s...

PT-2025-28147 · Unknown · Gavias Halpes

Name of the Vulnerable Software and Affected Versions: Gavias Halpes versions prior to 1.2.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

CVE-2025-52796

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affects WP-Recall: from n/a through 16.26.14...

CVE-2025-32311

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuanticaLabs Pressroom pressroom allows Reflected XSS.This issue affects Pressroom: from n/a through = 7.0...

CVE-2025-49245

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Reflected XSS.This issue affects Testimonials Showcase: from n/a through = 1.9.16...

CVE-2025-52798

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through 3.0.6...

CVE-2025-49274

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in awordpresslife Neom Blog neom-blog allows Reflected XSS.This issue affects Neom Blog: from n/a through = 0.0.9...

CVE-2025-24771

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Content Manager Light content-manager-light allows Reflected XSS.This issue affects Content Manager Light: from n/a through = 3.2...

CVE-2025-28978

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hung Trang Si SB Breadcrumbs sb-breadcrumbs allows Reflected XSS.This issue affects SB Breadcrumbs: from n/a through = 1.0...

CVE-2025-31037

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through = 2.4.5...

CVE-2025-52796

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affects WP-Recall: from n/a through 16.26.14...