CVE-2022-21710

ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:<img src=x onerror=alert()>}}`. This issue has a patch in version 2.3.4.

• CWE-79
• CWE-79

• https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/7c86644158388620c6c858258cc4e1a8de6e48eaPatch, Third Party Advisory
• https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/bf568edd892adb8528dcb64f75dddf3eeaccc12cPatch, Third Party Advisory
• https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/security/advisories/GHSA-mgcp-qw2r-6832Exploit, Third Party Advisory
• https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/7c86644158388620c6c858258cc4e1a8de6e48eaPatch, Third Party Advisory
• https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/bf568edd892adb8528dcb64f75dddf3eeaccc12cPatch, Third Party Advisory
• https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/security/advisories/GHSA-mgcp-qw2r-6832Exploit, Third Party Advisory

Published

Jan 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21704log4js-node is a port of log4js to node.js. In affected vers…5.5
• CVE-2022-21705Octobercms is a self-hosted CMS platform based on the Larave…7.2
• CVE-2022-21706Zulip is an open-source team collaboration tool with topic-b…9.8
• CVE-2022-21707wasmCloud Host Runtime is a server process that securely hos…8.1
• CVE-2022-21708graphql-go is a GraphQL server with a focus on ease of use. …6.5
• CVE-2022-2171The Progressive License WordPress plugin through 1.1.0 is la…5.4
• CVE-2022-21711elfspirit is an ELF static analysis and injection framework …7.1
• CVE-2022-21712twisted is an event-driven networking engine written in Pyth…7.5
• CVE-2022-21713Grafana is an open-source platform for monitoring and observ…4.3
• CVE-2022-21715CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…6.1
• CVE-2022-21716Twisted is an event-based framework for internet application…7.5
• CVE-2022-21718Electron is a framework for writing cross-platform desktop a…5