What’s Vulnerable › Vulnerabilities

CVE-2025-7363: TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser function

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-08 · updated 2026-06-17
• Weakness: CWE-79

Description

The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript. This issue affects Mediawiki - TitleIcon extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Affected products

• Wikimedia Foundation Mediawiki - TitleIcon extension: from 1.39.x before 1.39.13; from 1.42.x before 1.42.7; from 1.43.x before 1.43.2 — fixed in 1.39.13, 1.42.7, 1.43.2

How to fix

Upgrade to a fixed version: Wikimedia Foundation Mediawiki - TitleIcon extension 1.39.13, 1.42.7, 1.43.2. Check the vendor advisory for mitigations.

References

• https://gerrit.wikimedia.org/r/q/I107ab638fecbf52b5bec3f02726ed24b1ae74429
• https://gerrit.wikimedia.org/r/q/I2e8c73445172679634f6ec64d37cf82507dfa110
• https://phabricator.wikimedia.org/T394721
• https://phabricator.wikimedia.org/T394721

Get alerted when CVE-2025-7363 or the next vulnerability affects your stack