CVE-2024-36123

Citizen is a MediaWiki skin. The page MediaWiki:Tagline can render unescaped content, enabling stored cross-site scripting via editing the MediaWiki namespace (e.g., users with editinterface or sysop privileges). Root cause: unescaped output in MediaWiki:Tagline. Impact: potential HTML/JavaScript...

CVE-2024-47536

Citizen is a MediaWiki skin where a vulnerability allows a user with the editmyprivateinfo right (or someone who can modify their own name) to inject XSS by setting the real name to a payload. Affected components: Citizen skin and related user-info handling in includes/Components/CitizenComponent...

CVE-2025-49578

Citizen is a MediaWiki skin. CVE-2025-49578 describes an XSS where date messages produced by Language::userDate are inserted into raw HTML, enabling stored XSS on wikis where a user has the editinterface right but not the editsitejs right. The issue affects Citizen versions prior to 3.3.1 and is ...

CVE-2025-49577

Citizen is a MediaWiki skin; multiple connected sources describe a stored XSS vulnerability in the preference menu headings caused by unsanitized insertion of messages into raw HTML. Affected versions are prior to 3.3.1, and the issue is fixed in 3.3.1. Remediation: upgrade citizen-skin to versio...

CVE-2025-49579

CVE-2025-49579 affects the Citizen MediaWiki skin. The vulnerability arises because all system messages in Menu.mustache are inserted as raw HTML, enabling stored XSS when a user with editinterface but lacking editsitejs can edit messages. Affected versions are prior to Citizen 3.3.1, with fixed ...

CVE-2025-49576

Summary (mode C): CVE-2025-49576 affects the Citizen MediaWiki skin (StarCitizenTools) used in Wikis that employ the Citizen skin. The vulnerability arises because the system messages citizen-search-noresults-title and citizen-search-noresults-desc are inserted into raw HTML, allowing an attacker...

CVE-2025-49575

The CVE-2025-49575 issue affects the Citizen skin for MediaWiki. The underlying problem is that multiple system messages are inserted into the CommandPaletteFooter as raw HTML, enabling stored HTML injection by users who can edit those messages. This could allow arbitrary HTML execution in the af...

CVE-2025-53368

Citizen is a MediaWiki skin. CVE-2025-53368 affects Citizen versions 1.9.4 up to, but not including, 3.4.0, where page descriptions are inserted into raw HTML without sanitization when using the legacy search bar. This enables stored XSS by any user with page editing privileges targeting other us...

CVE-2025-53370

CVE-2025-53370 concerns the Citizen MediaWiki skin. Versions 1.9.4 up to 3.3.9 expose a stored XSS via the ShortDescription extension: the shortdesc is inserted into the DOM as raw HTML, enabling arbitrary HTML/JS execution by page edits. A patch exists in version 3.4.0. Public references and adv...