Vulnerabilities

TI-2025-38749 CVE-2025-62508 · GHSA-g955-vw6w-v6pp

Citizen vulnerable to stored XSS in sticky header button messages

MEDIUM 62

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00448 Published 2025-10-17 Fixed in 3.9.0 CWE-79

TI-2025-33331 CVE-2025-53369 · GHSA-p85q-mww9-gwqf

Citizen Short Description stored XSS vulnerability through wikitext

HIGH 76

Short Description is a MediaWiki extension that provides local short description support.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00341 Published 2025-07-03 Fixed in 2c18bd2, 4.0.1 CWE-79

TI-2025-33332 CVE-2025-53370 · GHSA-prmv-7r8c-794g

Citizen stored XSS vulnerability through short descriptions

HIGH 70

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00386 Published 2025-07-03 Fixed in 3.4.0 CWE-79

TI-2025-33330 CVE-2025-53368 · GHSA-rq6g-6g94-jfr4

Citizen is vulnerable to stored XSS attack in the legacy search bar

HIGH 76

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0035 Published 2025-07-03 Fixed in 3.4.0 CWE-79

TI-2025-33086 CVE-2025-53093 · GHSA-jfj7-249r-7j2m

TabberNeue vulnerable to Stored XSS through wikitext

HIGH 76

TabberNeue is a MediaWiki extension that allows the wiki to create tabs.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0042 Published 2025-06-27 Fixed in 3.1.1 CWE-79

TI-2025-31589 CVE-2025-49576 · GHSA-86xf-2mgp-gv3g

Citizen allows stored XSS in search no result messages

MEDIUM 62

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00425 Published 2025-06-12 Fixed in 3.3.1 CWE-79

TI-2025-31591 CVE-2025-49578 · GHSA-2v3v-3whp-953h

Citizen allows stored XSS in user registration date message

MEDIUM 62

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00426 Published 2025-06-12 Fixed in 93c36ac, 3.3.1 CWE-79

TI-2025-31592 CVE-2025-49579 · GHSA-g3cp-pq72-hjpv

Citizen allows stored XSS in menu heading message

MEDIUM 62

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00409 Published 2025-06-12 Fixed in 93c36ac, 3.3.1 CWE-79

TI-2025-31588 CVE-2025-49575 · GHSA-4c2h-67qq-vm87

Citizen allows stored XSS in Command Palette tip messages

MEDIUM 62

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00425 Published 2025-06-12 Fixed in 93c36ac, 3.3.1 CWE-79

TI-2025-31590 CVE-2025-49577 · GHSA-jwr7-992g-68mh

Citizen allows stored XSS in preference menu headings

MEDIUM 62

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00425 Published 2025-06-12 Fixed in 3.3.1 CWE-79

TI-2025-15572 CVE-2025-21612 · GHSA-4x6x-8rm8-c37j

Cross-site Scripting in TabberTransclude in Extension:TabberNeue

HIGH 72

TabberNeue is a MediaWiki extension that allows the wiki to create tabs.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00504 Published 2025-01-06 Fixed in 2.7.2 CWE-79

TI-2024-31825 CVE-2024-47536 · GHSA-62r2-gcxr-426x

starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

MEDIUM 55

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.0046 Published 2024-09-30 Fixed in 2.31.0 CWE-79

TI-2024-23953 CVE-2024-36123

Citizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:Tagline

MEDIUM 64

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00472 Published 2024-06-03 Fixed in 2.16.0 CWE-79

TI-2022-06085 CVE-2022-21710

Cross-site Scripting in ShortDescription extension

MEDIUM 60

ShortDescription is a MediaWiki extension that provides local short description support.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01 Published 2022-01-24 Fixed in 2.3.4 CWE-79

Vulnerabilities

Filters