Cross-site Scripting (XSS)

mediawiki is vulnerable to cross-site scripting (XSS). The attack is possible because it allows the creation of a page that does not correspond to any user, e.g User:Foo/bar.js. Subsequently, an attacker will be able to create an account User:Foo and create a malicious script bar.js, which causes the malicious code within the script to be executed when the user loads the page with importScript( 'User:Foo/bar.js' );.