CVE-2025-53370CWE-79

Citizen stored XSS vulnerability through short descriptions

High · published July 3, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00377 · 30.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-03T19:45Z
EPSS history
Timeline
  • 03 JUL 19:45Z
    Citizen stored XSS vulnerability through short descriptions
    cvelistv5