CVE-2025-11261

N/A Unknown
Cross-Site Scripting

📋 TL;DR

This is a cross-site scripting (XSS) vulnerability in MediaWiki's JavaScript language module that allows attackers to inject malicious scripts into web pages. It affects MediaWiki installations running vulnerable versions, potentially compromising user sessions and data. Users of affected MediaWiki instances are at risk.

💻 Affected Systems

Products:
  • Wikimedia Foundation MediaWiki
Versions: MediaWiki versions before 1.39.15, 1.43.5, and 1.44.2
Operating Systems: All operating systems running MediaWiki
Default Config Vulnerable: ⚠️ Yes
Notes: Affects the JavaScript language module in MediaWiki's resources directory. All MediaWiki installations using vulnerable versions are affected regardless of configuration.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or perform actions on behalf of authenticated users.

🟠

Likely Case

Session hijacking, cookie theft, or defacement of wiki pages through crafted malicious input.

🟢

If Mitigated

Limited impact if input validation and output encoding are properly implemented elsewhere, though the vulnerability still exists.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

XSS vulnerabilities typically have low exploitation complexity. The vulnerability is in a core component, making exploitation straightforward if details become public.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: MediaWiki 1.39.15, 1.43.5, or 1.44.2

Vendor Advisory: https://phabricator.wikimedia.org/T406322

Restart Required: No

Instructions:

1. Backup your MediaWiki installation and database. 2. Download the patched version from mediawiki.org. 3. Replace the vulnerable files with patched versions. 4. Clear caches if necessary. 5. Verify the update was successful.

🔧 Temporary Workarounds

Input Validation Enhancement

all

Implement additional input validation and output encoding for user-supplied data in the affected module.

Content Security Policy (CSP)

all

Implement a strict Content Security Policy to mitigate XSS impact by restricting script execution sources.

🧯 If You Can't Patch

  • Implement web application firewall (WAF) rules to block XSS payloads
  • Disable or restrict the affected JavaScript language module if not critical

🔍 How to Verify

Check if Vulnerable:

Check your MediaWiki version and compare against affected versions. Review the resources/src/mediawiki.Language/mediawiki.Language.Js file for proper input sanitization.

Check Version:

Check the LocalSettings.php file or MediaWiki's Special:Version page for version information.

Verify Fix Applied:

Verify that your MediaWiki version is 1.39.15, 1.43.5, or 1.44.2 or higher. Test XSS payloads in the affected component to ensure they are properly neutralized.

📡 Detection & Monitoring

Log Indicators:

  • Unusual JavaScript payloads in request logs
  • Multiple failed XSS attempts
  • Suspicious user agent strings containing script tags

Network Indicators:

  • HTTP requests containing script tags or JavaScript in parameters
  • Unexpected redirects to external domains

SIEM Query:

source="mediawiki_logs" AND (message="*<script>*" OR message="*javascript:*")

📊 Metadata

CVE ID: CVE-2025-11261
CVSS v3 Score: N/A (Unknown)
CWE: CWE-79
Published: February 3, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This