TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser function
Priority MEDIUM 58CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript. This issue affects Mediawiki - TitleIcon extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Fixed Mediawiki - TitleIcon extension (Wikimedia Foundation): 1.39.13, 1.42.7, 1.43.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wikimedia Foundation | Mediawiki - TitleIcon extension | 1.39.x to before 1.39.13; 1.42.x to before 1.42.7; 1.43.x to before 1.43.2 | 1.39.13, 1.42.7, 1.43.2 | Patch available | CNA |
- Mediawiki - TitleIcon extension VendorWikimedia Foundation Affected 1.39.x to before 1.39.13; 1.42.x to before 1.42.7; 1.43.x to before 1.43.2 Fixed in 1.39.13, 1.42.7, 1.43.2 Patch available CNA
Remediation
- Fix · CNA Mediawiki - TitleIcon extension (Wikimedia Foundation) Fixed in 1.39.13, 1.42.7, 1.43.2
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7363
- 2026-10-03 Alias added: GHSA-rxx8-835q-qmhv
References
More Wikimedia Foundation vulnerabilities
- TI-2025-11006 The compare API module breaks Extension:Lockdown CVSS 4.0CRITICAL 10.0
- TI-2024-32110 Backticks can allow the usage of not-allowed SQL functions CVSS 4.0HIGH 8.8
- TI-2026-65500 Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters CVSS 3.1HIGH 7.5
- TI-2026-64588 DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) CVSS 3.1HIGH 7.5
- TI-2026-42112 SQLi in Cargo extension via year range filter CVSS 4.0MEDIUM 6.9
- TI-2026-42110 Stored XSS through Cargo's map format CVSS 4.0MEDIUM 6.9
Sources
- CVE-2025-7363 · CVE Program
- CVE-2025-7363 · NVD
- FIRST EPSS
- GHSA-rxx8-835q-qmhv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences