CVE-2023-51704: Mediawiki

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.

Affected products

• Mediawiki Mediawiki: before 1.35.14 (fixed in 1.35.14); from 1.36.0, before 1.39.6 (fixed in 1.39.6); from 1.40.0, before 1.40.2 (fixed in 1.40.2)

Published 2023-12-22. Last modified 2026-06-17.