PT-2025-28642 · Mediawiki · Titleicon Extension+1

Somerandomdeveloper · Published 2025-07-08 · Updated 2025-07-08 · CVE-2025-7363

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: MediaWiki - TitleIcon extension versions 1.39.X through 1.39.12 MediaWiki - TitleIcon extension versions 1.42.X through 1.42.6 MediaWiki - TitleIcon extension versions 1.43.X through 1.43.1

Description: The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon unicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript.

Recommendations: For MediaWiki - TitleIcon extension versions 1.39.X through 1.39.12, update to version 1.39.13 or later. For MediaWiki - TitleIcon extension versions 1.42.X through 1.42.6, update to version 1.42.7 or later. For MediaWiki - TitleIcon extension versions 1.43.X through 1.43.1, update to version 1.43.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-7363

Affected Products

Mediawiki

Titleicon Extension

References · 5

• 🔥 https://phabricator.wikimedia.org/T394721 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7363 · Security Note
• https://twitter.com/CVEnew/status/1942658149112320398 · Twitter Post
• https://gerrit.wikimedia.org/r/q/I2e8c73445172679634f6ec64d37cf82507dfa110 · Note
• https://gerrit.wikimedia.org/r/q/I107ab638fecbf52b5bec3f02726ed24b1ae74429 · Note