CVE-2021-44855: Mediawiki

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature.

Affected products

• Mediawiki Mediawiki: before 1.35.5 (fixed in 1.35.5); from 1.36.0, before 1.36.3 (fixed in 1.36.3); version 1.37.0 only

Published 2022-12-26. Last modified 2026-06-17.