CVE-2025-62698: Stored XSS through system messages in ExternalGuidance

Published Oct 20, 2025

Updated

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39.

Affected Software

1 affected component

Wikimedia Foundation Mediawiki - ExternalGuidance>1.39

Event History

Oct 20, 2025

CVE Published

via MITRE·06:07 PM

Data Sourced

via MITRE·06:07 PM

DescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-62698?

CVE-2025-62698 is classified as a high severity vulnerability due to the potential for stored cross-site scripting (XSS) attacks.

How do I fix CVE-2025-62698?

To fix CVE-2025-62698, upgrade Mediawiki - ExternalGuidance to version 1.39 or later where the vulnerability has been addressed.

What type of vulnerability is CVE-2025-62698?

CVE-2025-62698 is an improper neutralization of input during web page generation, leading to a stored XSS vulnerability.

Which versions of Mediawiki - ExternalGuidance are affected by CVE-2025-62698?

CVE-2025-62698 affects Mediawiki - ExternalGuidance versions prior to 1.39.

Can CVE-2025-62698 lead to data compromise?

Yes, CVE-2025-62698 can allow attackers to execute malicious scripts in the context of the user’s session, potentially compromising sensitive data.