Skip to content
Threat Feed
Subscribe

Vendor

MediaWiki

2 briefs RSS
high advisory

MediaWiki Maps Stored XSS via display_map `overlays` Parameter (CVE-2026-52854)

A high-severity stored cross-site scripting (XSS) vulnerability, CVE-2026-52854, exists in the MediaWiki Maps extension (versions prior to 12.1.3), allowing any authenticated user with edit permissions to inject malicious JavaScript into the `overlays` parameter of the `display_map` parser function, leading to arbitrary client-side code execution in a victim's browser.

mediawiki/maps xss mediawiki web-vulnerability web-application
1r 2t
critical advisory

MediaWiki Multiple Vulnerabilities Lead to Remote Code Execution

A remote, authenticated attacker can exploit multiple vulnerabilities in MediaWiki to execute arbitrary code, disclose information, perform a cross-site scripting attack, or cause a denial of service condition.

mediawiki rce xss dos
2r 3t