CVE-2020-9382: Widgets Project Widgets

Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days.

An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki's {{#widget:}} parser function.

Affected products

• Widgets Project Widgets: up to and including 1.4.0

Published 2020-02-24. Last modified 2026-06-17.