CVE-2025-11937: Stored XSS through a system message in SecurePoll

Published Oct 18, 2025

Updated

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.

Affected Software

1 affected component

Wikimedia Foundation Mediawiki - SecurePoll Extension

Event History

Oct 18, 2025

CVE Published

via MITRE·05:14 AM

Data Sourced

via MITRE·05:14 AM

DescriptionWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-11937?

CVE-2025-11937 is classified as a high severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.

How do I fix CVE-2025-11937?

To mitigate CVE-2025-11937, update to the latest version of the Mediawiki - SecurePoll Extension where the vulnerability has been patched.

What type of vulnerability is CVE-2025-11937?

CVE-2025-11937 is an improper neutralization of input vulnerability during web page generation, leading to stored cross-site scripting (XSS).

Who is affected by CVE-2025-11937?

CVE-2025-11937 affects users of the Wikimedia Foundation Mediawiki - SecurePoll Extension.

Can CVE-2025-11937 lead to data compromise?

Yes, CVE-2025-11937 can lead to data compromise as attackers may execute malicious scripts in the context of the user’s browser.