CVE-2025-6591: HTML injection in API action=feedcontributions output from i18n message
Published Feb 2, 2026
·Updated
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php.
This issue affects MediaWiki: from before 1.39.13, 1.42.7 1.43.2, 1.44.0.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki<1.39.13, >=1.42.7<=1.42.7, >=1.43.2<=1.43.2, >=1.44.0<=1.44.0
Event History
Feb 2, 2026
CVE Published
via MITRE·11:02 PM
Data Sourced
via MITRE·11:02 PM
Description
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-6591?
CVE-2025-6591 has a severity rating that may impact the integrity of the MediaWiki web application.
2
How do I fix CVE-2025-6591?
To fix CVE-2025-6591, upgrade MediaWiki to versions 1.39.13 or later, or 1.42.7 or later, or versions 1.43.3 and higher.
3
What versions of MediaWiki are affected by CVE-2025-6591?
CVE-2025-6591 affects MediaWiki versions prior to 1.39.13, 1.42.7, 1.43.2, and 1.44.0.
4
What type of attack does CVE-2025-6591 facilitate?
CVE-2025-6591 facilitates HTML injection attacks through the API action=feedcontributions output.
5
Who is responsible for addressing CVE-2025-6591 vulnerability?
The Wikimedia Foundation is responsible for addressing the CVE-2025-6591 vulnerability in MediaWiki.