CVE-2025-61638
Medium · 4.8CVSS
4.8
EPSS
0.3%
Published
Feb 3, 2026
CISA due date
—
The record
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | mediawiki | 0 | 1.35.14-1.1.mga9 |
Related vulnerabilities
- CVE-2025-61653 Vulnerability in Wikimedia Foundation TextExtracts. Also affects mediawiki
- CVE-2025-61646 Vulnerability in Wikimedia Foundation MediaWiki. Also affects mediawiki
- CVE-2025-11173 Vulnerability in Wikimedia Foundation OATHAuth. Also affects mediawiki
- CVE-2025-11261 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site… Also affects mediawiki
- CVE-2025-61641 Vulnerability in Wikimedia Foundation MediaWiki. Also affects mediawiki
- CVE-2025-61643 Vulnerability in Wikimedia Foundation MediaWiki. Also affects mediawiki
- CVE-2025-61639 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia… Also affects mediawiki
- CVE-2025-61635 Vulnerability in Wikimedia Foundation ConfirmEdit. Also affects mediawiki