CVE-2020-10959: Mediawiki

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.

Affected products

• Mediawiki Mediawiki: before 1.35 (fixed in 1.35)

Published 2020-06-02. Last modified 2026-06-17.