CVE-2025-61642: Stored XSS through system messages provided to CodexHtmlForms
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php.
This issue affects MediaWiki: from before 1.39.14, 1.43.4, 1.44.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61642?
CVE-2025-61642 has been classified as a medium severity vulnerability due to its potential for stored XSS attacks.
How do I fix CVE-2025-61642?
To fix CVE-2025-61642, update your MediaWiki installation to version 1.39.14 or later.
Who is affected by CVE-2025-61642?
Users of Wikimedia Foundation MediaWiki versions prior to 1.39.14 are affected by CVE-2025-61642.
What impact does CVE-2025-61642 have?
CVE-2025-61642 allows attackers to execute arbitrary JavaScript in the context of an affected web page, potentially compromising user data.
Is there a workaround for CVE-2025-61642?
A temporary workaround for CVE-2025-61642 is to sanitize input in forms to prevent stored XSS, until an upgrade can be performed.