CVE-2012-2698: Mediawiki

Medium severity, CVSS 4.3. EPSS: 4.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page.

Affected products

• Mediawiki Mediawiki: version 1.18 only; version 1.18.0 only; version 1.18.1 only; version 1.18.2 only; version 1.18.3 only; up to and including 1.17.4; …

Published 2012-06-29. Last modified 2026-06-16.