What’s Vulnerable › Vulnerabilities

CVE-2025-53370: Citizen stored XSS vulnerability through short descriptions

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-03 · updated 2026-06-17
• Weakness: CWE-79

Description

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.

Affected products

• StarCitizenTools mediawiki-skins-Citizen: from 1.9.4 before 3.4.0 — fixed in 3.4.0

How to fix

Upgrade to a fixed version: StarCitizenTools mediawiki-skins-Citizen 3.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/c85a40bddc8651fff66df83a72debddcb34f0521
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-prmv-7r8c-794g

Get alerted when CVE-2025-53370 or the next vulnerability affects your stack