Hi everyone,

The following is an unofficial security announcement for Extension:GoogleDocTag and Extension:YotpoReviews. (It is unofficial because Wikimedia doesn't maintain these extensions).

We recently discovered an XSS vulnerability in both these extensions. If you use either of these extensions we strongly urge you to upgrade.

For YotpoReviews please upgrade to either: 0.4 or 0.3.1 For GoogleDocTag please upgrade to either: 0.6 or 0.4.1

New versions of these extensions can be downloaded from https://www.mediawiki.org/wiki/Special:ExtensionDistributor or directly from the git repo.

Relevant gerrit patches:

YotpoReviews: https://gerrit.wikimedia.org/r/#/q/I5cbd95ed37a117740e59c66200141e08131a3111 GoogleDocTag: https://gerrit.wikimedia.org/r/#/q/Iaae66049011e5a2b10d82ac2eaaa9aecebf16345

Thanks, Brian Wolff