CVE-2025-32078: XSSes and potential RCE in Special:VersionCompare
Published Apr 11, 2025
·Updated
Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.
Affected Software
1 affected component
Wikimedia Foundation Mediawiki - Version Compare Extension>=1.39<=1.43
Event History
Apr 11, 2025
CVE Published
via MITRE·04:24 PM
Data Sourced
via MITRE·04:24 PM
DescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness
Sep 7, 57263
Event
via FIRST·09:49 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-32078?
CVE-2025-32078 is classified as a medium severity Cross-Site Scripting (XSS) vulnerability.
2
What software is affected by CVE-2025-32078?
CVE-2025-32078 affects the Mediawiki - Version Compare Extension from versions 1.39 to 1.43.
3
How do I fix CVE-2025-32078?
To fix CVE-2025-32078, upgrade the Mediawiki - Version Compare Extension to a version above 1.43.
4
What type of vulnerability is CVE-2025-32078?
CVE-2025-32078 is an improper encoding or escaping of output vulnerability that allows for XSS.
5
Can CVE-2025-32078 be exploited remotely?
Yes, CVE-2025-32078 can be exploited remotely to execute malicious scripts in users' browsers.