CVE-2025-53487
Last modified
CVE-2025-53487 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message keys to be rendered unescaped. This issue affects Mediawiki - ApprovedRevs extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message keys to be rendered unescaped. This issue affects Mediawiki - ApprovedRevs extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-53487?
How severe is CVE-2025-53487?
How do I fix CVE-2025-53487?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-53481Uncontrolled Resource Consumption vulnerability in Wikimedia…7.5
- CVE-2025-53482Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2025-53483ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage…8.8
- CVE-2025-53484User-controlled inputs are improperly escaped in: * …9.8
- CVE-2025-53485SetTranslationHandler.php does not validate that the user is…7.5
- CVE-2025-53486The WikiCategoryTagCloud extension is vulnerable to reflecte…5.4
- CVE-2025-53488Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2025-53489Improper Neutralization of Input During Web Page Generation …5.6
- CVE-2025-5349Improper access control on the NetScaler Management Interfac…8.8
- CVE-2025-53490Improper Neutralization of Input During Web Page Generation …5.6
- CVE-2025-53491Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2025-53492Improper Neutralization of Input During Web Page Generation …3.7
Are you affected by CVE-2025-53487?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST