CVE-2025-53368CWE-79

Citizen is vulnerable to stored XSS attack in the legacy search bar

High · published July 3, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-03T19:34Z
EPSS history
Timeline
  • 03 JUL 19:34Z
    Citizen is vulnerable to stored XSS attack in the legacy search bar
    cvelistv5