CVE-2025-61650
Unknown Unknown - Not Provided
Cross-Site Scripting in Wikimedia CheckUser UserInfoCard Service

Publication date: 2026-02-03

Last updated on: 2026-02-03

Assigner: wikimedia-foundation

Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php. This issue affects CheckUser: from * before 795bf333272206a0189050d975e94b70eb7dc507.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-03
Last Modified
2026-02-03
Generated
2026-06-16
AI Q&A
2026-02-03
EPSS Evaluated
2026-06-14
NVD
CVE-2025-61650
EUVD
EUVD-2025-206642
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wikimedia checkuser to 795bf333272206a0189050d975e94b70eb7dc507 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

This vulnerability can allow attackers to inject and execute malicious JavaScript code in the context of the affected MediaWiki CheckUser UserInfoCard. This could lead to unauthorized actions such as session hijacking, defacement, or other malicious activities executed in the user's browser when viewing the UserInfoCard. However, the risk rating assigned to this vulnerability is low. [1]

Executive Summary

CVE-2025-61650 is a stored Cross-Site Scripting (XSS) vulnerability in the UserInfoCard feature of the CheckUser extension for MediaWiki. It occurs because unsafe handling of message keys related to user groups allows malicious JavaScript payloads to be injected and stored. When the UserInfoCard is rendered, these scripts execute, potentially triggering actions like JavaScript alerts. The vulnerability was hard to detect with standard X-XSS tests and required special payloads for detection. [1]

Detection Guidance

This vulnerability is difficult to detect using standard X-XSS language tests because script tags injected post-DOM load do not execute. Detection involves testing for stored Cross-Site Scripting (XSS) in the UserInfoCard feature by injecting alternative payloads such as <img src="" onerror="alert(1)"> into message keys related to user groups (e.g., "checkuser-userinfocard-groups" and "checkuser-userinfocard-global-groups"). There are no specific commands provided, but testing should focus on injecting and rendering such payloads in the UserInfoCard to observe if JavaScript executes. [1]

Mitigation Strategies

Immediate mitigation involves applying the security patch developed for the CheckUser extension that escapes unsafe inputs in message keys to prevent script execution. This patch has been merged into the master branch and backported to stable branches (wmf.16 and wmf.17). Updating your CheckUser extension to the patched version will mitigate the vulnerability. Additionally, coordinate with your deployment team to ensure the patch is applied and tested before release. [1]

Compliance Impact

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-61650. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart