Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
References (3)
Core 3
Core References
Issue Tracking, Vendor Advisory
https://phabricator.wikimedia.org/T368628
Exploit, Issue Tracking, Vendor Advisory
https://phabricator.wikimedia.org/T370081
Scores
CVSS v3
4.8
EPSS
0.0031
EPSS Percentile
23.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
wikimedia/apex
1.13.0 - 1.39.9
Published
Oct 05, 2024
Tracked Since
Feb 18, 2026