CVE-2025-53487CWE-79

ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messages

Medium · published July 7, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message keys to be rendered unescaped.

This issue affects Mediawiki - ApprovedRevs extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-07T15:13Z
EPSS history
Timeline
  • 07 JUL 15:13Z
    ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messages
    cvelistv5