PT-2026-5739 · Wikimedia Foundation · Checkuser
CVE-2025-61651
·
Published
2026-02-03
·
Updated
2026-02-03
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Wikimedia Foundation CheckUser versions prior to 1.44.1
Description
The software contains a flaw related to improper input neutralization during web page generation, potentially leading to Cross-site Scripting (XSS). This issue is found in the
buildUserElement.Js file within the modules/ext.CheckUser/checkuser/checkUserHelper directory.Recommendations
Update to CheckUser version 1.44.1 or later. As a temporary workaround, consider restricting access to the
buildUserElement.Js file to minimize the risk of exploitation.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Checkuser