CVE-2021-42042: Mediawiki

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-invalid-title MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.

Affected products

• Mediawiki Mediawiki: up to and including 1.36.2

Published 2021-10-06. Last modified 2026-06-17.