Vendor
The Wikimedia Foundation
14 known vulnerabilities in products by The Wikimedia Foundation, 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-47841 | Path traversal when loading stylesheets | 7.5 | |
| Medium | CVE-2019-19329 | Wikimedia Wikidata Query Service GUI: Cross-Site Scripting (XSS) | 6.1 | |
| Medium | CVE-2021-30458 | Wikimedia Foundation Parsoid: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2026-34089 | Memory leak in Scribunto causes runJobs.php to run out of memory | 7.5 | |
| Medium | CVE-2019-19327 | Wikimedia Wikidata Query Service GUI: security vulnerability | 6.1 | |
| Medium | CVE-2019-19328 | Wikimedia Wikidata Query Service GUI: security vulnerability | 6.1 | |
| High | CVE-2024-47845 | CSS sanitizer used incorrectly, and is easily bypassed | 8.2 | |
| Medium | CVE-2020-36324 | Wikimedia Foundation Analytics-quarry-web: Cross-Site Scripting (XSS) | 6.1 | |
| Medium | CVE-2024-47840 | Stored XSS through sidebar in Apex skin | 4.8 | |
| Medium | CVE-2026-0671 | Multiple stored i18n/message-key XSSes in UploadWizard | 6.1 | |
| Medium | CVE-2026-0817 | CampaignEvents API missing authorization exposes meeting and chat URLs | 5.3 | |
| Medium | CVE-2025-61638 | Sanitizer::validateAttributes data-XSS | 4.8 | |
| Medium | CVE-2026-22710 | Stored XSS through autocomment system messages in Wikibase | 5.4 | |
| Medium | CVE-2018-25065 | Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting | 3.5 |
Products
| Wikimedia Wikidata Query Service GUI | 3 | 0 |