Greetings-

With the security/maintenance release of MediaWiki 1.39.13/1.42.7/1.43.2, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]:

ManageWiki + ( https://github.com/miraheze/ManageWiki/security/advisories/GHSA-gg42-cv66-f5..., CVE-2025-32956) - SQL injection vulnerability in NamespaceMigrationJob https://github.com/miraheze/ManageWiki/commit/f504ed8eeb59b57ebb90f93cd44f23...

IPInfo + (T392976 https://phabricator.wikimedia.org/T392976, CVE-2025-53481) - Denial of service vector on ipinfo/v0/norevision https://gerrit.wikimedia.org/r/q/I474b7a1b3bc1e7597fee0826a18a0cf042359f0f

IPInfo + (T392976 https://phabricator.wikimedia.org/T392976, CVE-2025-53481) - Denial of service vector on ipinfo/v0/norevision https://gerrit.wikimedia.org/r/q/I08a7154f8fa08bb6f0940e522075bdc2a3d4433f

IPInfo + (T394393 https://phabricator.wikimedia.org/T394393, CVE-2025-53482) - IPInfo: Message key XSS through several IPInfo messages in infobox and popup https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1146685

IPInfo + (T394393 https://phabricator.wikimedia.org/T394393, CVE-2025-53482) - IPInfo: Message key XSS through several IPInfo messages in infobox and popup https://gerrit.wikimedia.org/r/q/Ibb9b7dcb04f551a3da32e9de09a8ac11caa2a3aa

SecurePoll + (T392341 https://phabricator.wikimedia.org/T392341, CVE-2025-53483) - SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SecurePoll/+/1149618

SecurePoll + (T392341 https://phabricator.wikimedia.org/T392341, CVE-2025-53484) - SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation https://gerrit.wikimedia.org/r/q/I5fb4da635b538b6ef121ae77d9088737fd8bf0de

SecurePoll + (T392341 https://phabricator.wikimedia.org/T392341, CVE-2025-53483) - SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation https://gerrit.wikimedia.org/r/q/I7a771f81cc72bd5c6242767cf3f5e19fa140accc

SecurePoll + (T392341 https://phabricator.wikimedia.org/T392341, CVE-2025-53485) - SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation https://gerrit.wikimedia.org/r/q/Iaaae70289464b8f097ff8d2d6c828ddf942d2d60

SecurePoll + (T392341 https://phabricator.wikimedia.org/T392341, CVE-2025-53484) - SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation https://gerrit.wikimedia.org/r/q/Id6e0c8c3020c293460010ef0019bc6c40d43b596

WikiCategoryTagCloud + (T394590 https://phabricator.wikimedia.org/T394590, CVE-2025-53486) - Reflected XSS in WikiCategoryTagCloud https://gerrit.wikimedia.org/r/q/Idd68cf2372aedd916687d30b1bd09ebb48fcfd17

ApprovedRevs + (T394383 https://phabricator.wikimedia.org/T394383, CVE-2025-53487) - Stored XSS through system messages in Extension:ApprovedRevs https://gerrit.wikimedia.org/r/q/Ifcab085111e7898da485a5e2ae287fee4e6d167b

CheckUser + (T394692 https://phabricator.wikimedia.org/T394692, CVE-2025-53478) - Special:Investigate 'IPs and User agents' tab has i18n XSS vectors https://gerrit.wikimedia.org/r/q/I3a1e21b6800ff4d813a33ee9fe9b7ccf070b6b2e

CheckUser + (T394693 https://phabricator.wikimedia.org/T394693, CVE-2025-53479) - Special:CheckUser has i18n XSS vectors https://gerrit.wikimedia.org/r/q/I159e14543912cb3bc7f4a00c3090c0285b154786

CheckUser + (T394700 https://phabricator.wikimedia.org/T394700, CVE-2025-53480) - Special:Investigate 'Account information' tab has i18n XSS vectors https://gerrit.wikimedia.org/r/q/I777fc55fef15c3b00df0db268af2b64cb2d6e381

MsUpload + (T394864 https://phabricator.wikimedia.org/T394864, CVE-2025-7362) - Stored XSS through a system message in MsUpload https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f

TitleIcon + (T394721 https://phabricator.wikimedia.org/T394721, CVE-2025-7363) - XSS in TitleIcon https://gerrit.wikimedia.org/r/q/I107ab638fecbf52b5bec3f02726ed24b1ae74429

TwoColConflict + (T394938 https://phabricator.wikimedia.org/T394938, CVE-2025-53494) - Stored XSS in TwoColConflict https://gerrit.wikimedia.org/r/c/mediawiki/extensions/TwoColConflict/+/11500...

MintyDocs + (T395376 https://phabricator.wikimedia.org/T395376, CVE-2025-53493) - Stored XSS in MintyDocs https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MintyDocs/+/1151800

MintyDocs + (T395737 https://phabricator.wikimedia.org/T395737, CVE-2025-53492) - Stored XSS in MintyDocs https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MintyDocs/+/1152771

FlaggedRevs + (T394397 https://phabricator.wikimedia.org/T394397, CVE-2025-53491) - Stored XSS in FlaggedRevs https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlaggedRevs/+/1165929

CampaignEvents + (T395622 https://phabricator.wikimedia.org/T395622, CVE-2025-53490) - Multiple XSS in CampaignEvents https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CampaignEvents/+/11659...

GoogleDocs4MW + (T395949 https://phabricator.wikimedia.org/T395949, CVE-2025-53489) - XSS in GoogleDocs4MW https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GoogleDocs4MW/+/115526...

wikihiero + (T396524 https://phabricator.wikimedia.org/T396524, CVE-2025-53488) - Stored XSS in WikiHiero https://gerrit.wikimedia.org/r/c/mediawiki/extensions/wikihiero/+/1166018

RelatedArticles + (T396413 https://phabricator.wikimedia.org/T396413, CVE-2025-53497) - Stored XSS in RelatedArticles https://gerrit.wikimedia.org/r/c/mediawiki/extensions/RelatedArticles/+/1166...

MediaSearch + (T396946 https://phabricator.wikimedia.org/T396946, CVE-2025-53496) - Stored XSS in MediaSearch https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MediaSearch/+/1166030

AbuseFilter + (T396750 https://phabricator.wikimedia.org/T396750, CVE-2025-53495) - Unauthorized Disclosure of IP Reputation in AbuseFilter https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1166040

AbuseFilter + (T397196 https://phabricator.wikimedia.org/T397196, CVE-2025-53499) - Unauthorized Inspection of Protected Variables in AbuseFilter https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1166045

AbuseFilter + (T397221 https://phabricator.wikimedia.org/T397221, CVE-2025-53498) - Lack of Audit Logging in AbuseFilter https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1166844

FeaturedFeeds + (T392279 https://phabricator.wikimedia.org/T392279, CVE-2025-53502) - HTML injection in FeaturedFeeds https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FeaturedFeeds/+/114974...

Scribunto + (T397524 https://phabricator.wikimedia.org/T397524, CVE-2025-53501) - Content Access Bypass in Scribunto https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Scribunto/+/1164541

MassEditRegex + (T397334 https://phabricator.wikimedia.org/T397334, CVE-2025-53500) - Stored XSS in MassEditRegex https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MassEditRegex/+/116387...

CentralAuth + (T389010 https://phabricator.wikimedia.org/T389010, CVE-2025-6926) - Security Authentication Bypass in CentralAuth https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165117

ManageWiki + ( https://github.com/miraheze/ManageWiki/security/advisories/GHSA-ccrf-x5rp-gp..., CVE-2025-32964) - ManageWiki Vulnerable To Permission Bypass When Disabling Extensions Requiring Certain Permissions In Special:ManageWiki/Extensions https://github.com/miraheze/ManageWiki/commit/00bebea43a3e3ff0157b5f04df17c1...

ManageWiki + ( https://github.com/miraheze/ManageWiki/security/advisories/GHSA-859x-46h8-vc..., CVE-2025-43861) - ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection https://github.com/miraheze/ManageWiki/commit/2f177dc83b28b727613215b835d403...

Citizen + ( https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisor..., CVE-2025-49575) - Citizen Allows Stored XSS In Command Palette Tip Messages https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/4fa69e1d0...

Citizen + ( https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisor..., CVE-2025-49576) - Citizen Allows Stored XSS In Search No Result Messages https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac77...

Citizen + ( https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisor..., CVE-2025-49577) - Citizen Allows Stored XSS In Preference Menu Headings https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac77...

Citizen + ( https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisor..., CVE-2025-49578) - Citizen Allows Stored XSS In User Registration Date Message https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/64cb5d7ab...

Citizen + ( https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisor..., CVE-2025-49579) - Citizen Allows Stored XSS In Menu Heading Message https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/54c8717d4...

TabberNeue + ( https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security..., CVE-2025-53093) - TabberNeue Vulnerable To Stored XSS Through Wikitext https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4...

ShortDescription + ( https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/se..., CVE-2025-53369) - Citizen Short Description Stored XSS Vulnerability Through Wikitext https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/co...

Citizen + ( https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisor..., CVE-2025-53368) - Citizen Is Vulnerable To Stored XSS Attack In The Legacy Search Bar https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb33...

Citizen + ( https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisor..., CVE-2025-53370) - Citizen Stored XSS Vulnerability Through Short Descriptions https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/c85a40bdd...

UrlShortener + (T394869 https://phabricator.wikimedia.org/T394869, CVE-2025-7056) - Stored XSS in UrlShortener https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UrlShortener/+/1166268

Quiz + (T394612 https://phabricator.wikimedia.org/T394612, CVE-2025-7057) - Stored XSS in Quiz https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Quiz/+/1166274

The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security@wikimedia.org or file a security task within Phabricator [3].

[1] https://phabricator.wikimedia.org/T389312 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs