CVE-2025-11261: Stored i18n XSS exposed by security patch for T402077
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js.
This issue affects MediaWiki: from before 1.39.15, 1.43.5, 1.44.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11261?
CVE-2025-11261 has a moderate severity level due to its potential for stored XSS attacks in vulnerable MediaWiki installations.
How do I fix CVE-2025-11261?
To fix CVE-2025-11261, upgrade to MediaWiki version 1.39.15 or later as this version addresses the vulnerability.
What systems are affected by CVE-2025-11261?
CVE-2025-11261 affects Wikimedia Foundation MediaWiki versions prior to 1.39.15.
What type of vulnerability is CVE-2025-11261?
CVE-2025-11261 is a stored i18n XSS vulnerability that arises from improper neutralization of input during web page generation.
Is CVE-2025-11261 easily exploitable?
Yes, CVE-2025-11261 is considered easily exploitable if the affected version of MediaWiki is deployed without mitigation measures.