CVE-2025-53484: SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped input
User-controlled inputs are improperly escaped in:
VotePage.php (poll option input)
ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names)
This allows attackers to inject JavaScript and compromise user sessions under certain conditions.
This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53484?
CVE-2025-53484 is rated as a medium severity vulnerability due to the potential for user session compromise.
How do I fix CVE-2025-53484?
To fix CVE-2025-53484, upgrade your MediaWiki SecurePoll installation to version 1.39.14, 1.42.8, or 1.43.3 or later.
What kind of attacks can be executed through CVE-2025-53484?
CVE-2025-53484 allows attackers to inject JavaScript which can compromise user sessions.
Which versions of MediaWiki SecurePoll are affected by CVE-2025-53484?
CVE-2025-53484 affects MediaWiki SecurePoll versions from 1.39.0 to 1.39.13, 1.42.0 to 1.42.7, and 1.43.0 to 1.43.2.
What components of MediaWiki SecurePoll are involved in CVE-2025-53484?
CVE-2025-53484 involves vulnerabilities in VotePage.php and the ResultPage's getPagesTab and getErrorsTab functions.