CVE Details
Basic Information
| Title | TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser function |
|---|---|
| Type | cve |
| Published | 2025-07-08T17:27:17.643Z |
| Modified | 2025-07-08T17:27:17.643Z |
Product Information
| Vendor | Wikimedia Foundation |
|---|---|
| Product | Mediawiki – TitleIcon extension |
| Version | 1.39.x |
CVSS Information
| Base Score | 0.0 () |
|---|
AI Analysis
| AI Description | A stored XSS vulnerability in the TitleIcon extension for MediaWiki allows attackers to inject JavaScript via the #titleicon_unicode parser function due to unsanitized user input. |
|---|---|
| AI Severity | High |
| AI Vendor | Wikimedia Foundation |
| AI Product | TitleIcon extension |
| AI Version | 1.39.x, 1.42.x, 1.43.x |
Affected Products
- Wikimedia Foundation Mediawiki – TitleIcon extension 1.39.x
- Wikimedia Foundation Mediawiki – TitleIcon extension 1.42.x
- Wikimedia Foundation Mediawiki – TitleIcon extension 1.43.x
Additional Information
| CWE List | CWE-79 |
|---|---|
| Source | wikimedia-foundation |
Description
The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript.
This issue affects Mediawiki – TitleIcon extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.