What’s Vulnerable › Vulnerabilities

CVE-2024-47782: Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-07 · updated 2026-06-17
• Weakness: CWE-79

Description

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on the wiki farm. However, the special page does not make any effort to escape the wiki name or description. Therefore, if a wiki sets its name and/or description to an XSS payload, the XSS will execute whenever the wiki is shown on Special:WikiDiscover. This issue has been patched with commit `2ce846dd93` and all users are advised to apply that patch. User unable to upgrade should block access to `Special:WikiDiscover`.

Affected products

• miraheze WikiDiscover: before 2024-10-06 — fixed in 2024-10-06

How to fix

Upgrade to a fixed version: miraheze WikiDiscover 2024-10-06. Check the vendor advisory for mitigations.

References

• https://github.com/miraheze/WikiDiscover/commit/2ce846dd93ddb9ec86f7472c4d57fe71a09dc827
• https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-wf48-rqx3-39mf
• https://issue-tracker.miraheze.org/T12697

Get alerted when CVE-2024-47782 or the next vulnerability affects your stack