CVE-2025-61637: Stored XSS through system messages in MW Core

Q: What is the severity of CVE-2025-61637?

CVE-2025-61637 is classified as a medium severity vulnerability due to potential abuse through stored XSS.

Q: How do I fix CVE-2025-61637?

To mitigate CVE-2025-61637, update your MediaWiki installation to version 1.39.15 or later.

Q: What versions of MediaWiki are affected by CVE-2025-61637?

CVE-2025-61637 affects MediaWiki versions prior to 1.39.15.

Q: What type of vulnerability is CVE-2025-61637?

CVE-2025-61637 is a stored Cross-Site Scripting (XSS) vulnerability.

Q: What impact does CVE-2025-61637 have on my MediaWiki installation?

Exploitation of CVE-2025-61637 could allow attackers to inject malicious scripts into system messages, affecting users who view those messages.

Published Feb 2, 2026

Updated

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js.

This issue affects MediaWiki: from before 1.39.14, 1.43.4, 1.44.1.

Affected Software

4 affected components

Wikimedia Foundation MediaWiki<1.39.14

MediaWiki MediaWiki<1.39.14

MediaWiki MediaWiki>=1.39.15<1.43.4

MediaWiki MediaWiki>=1.43.5<1.44.1

Event History

Feb 2, 2026

CVE Published

via MITRE·11:54 PM

Data Sourced

via MITRE·11:54 PM

DescriptionWeakness

Feb 3, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeaknessAffected Software

Nov 17, 58175

Event

via NVD·01:16 PM

Frequently Asked Questions

What is the severity of CVE-2025-61637?

CVE-2025-61637 is classified as a medium severity vulnerability due to potential abuse through stored XSS.

How do I fix CVE-2025-61637?

To mitigate CVE-2025-61637, update your MediaWiki installation to version 1.39.15 or later.

What versions of MediaWiki are affected by CVE-2025-61637?