CVE-2021-30458: Wikimedia Parsoid

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.

Affected products

• Wikimedia Parsoid: before 0.11.1 (fixed in 0.11.1); from 0.12.0, before 0.12.2 (fixed in 0.12.2)

Published 2021-04-09. Last modified 2026-06-17.