CVE-2025-62662: Stored XSS through system messages in AdvancedSearch

Published Oct 18, 2025

Updated

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.

Affected Software

1 affected component

Wikimedia Foundation Mediawiki - AdvancedSearch Extension>1.39

Event History

Oct 18, 2025

CVE Published

via MITRE·04:19 AM

Data Sourced

via MITRE·04:19 AM

DescriptionWeakness

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-62662?

CVE-2025-62662 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS).

How do I fix CVE-2025-62662?

To remediate CVE-2025-62662, upgrade the Mediawiki - AdvancedSearch Extension to version 1.39 or later.

What type of vulnerability is CVE-2025-62662?

CVE-2025-62662 is an improper neutralization of input during web page generation vulnerability, specifically a stored XSS issue.

Which versions of Mediawiki - AdvancedSearch Extension are affected by CVE-2025-62662?

CVE-2025-62662 affects Mediawiki - AdvancedSearch Extension versions before 1.39.

Can CVE-2025-62662 lead to data breaches?

Yes, CVE-2025-62662 can potentially lead to data breaches as it allows attackers to execute malicious scripts in the context of a user's session.