CVE-2013-4308

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-09-12 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject.

Affected products

Liquidthreads Project Liquidthreads: 2.0-alpha, 2.1-alpha

References

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
http://osvdb.org/96906
http://seclists.org/oss-sec/2013/q3/553
http://www.securityfocus.com/bid/62218
https://bugzilla.wikimedia.org/show_bug.cgi?id=53320
https://exchange.xforce.ibmcloud.com/vulnerabilities/86891
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
http://osvdb.org/96906
http://seclists.org/oss-sec/2013/q3/553
http://www.securityfocus.com/bid/62218
https://bugzilla.wikimedia.org/show_bug.cgi?id=53320
https://exchange.xforce.ibmcloud.com/vulnerabilities/86891

Get alerted when CVE-2013-4308 or the next vulnerability affects your stack