{"id":"CVE-2025-7363","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-7363","generatedAt":"2026-10-28T09:41:38.234Z","title":"The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function.","description":"The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript.\n\n\n\n\nThis issue affects Mediawiki - TitleIcon extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.","published":"2025-07-08T18:15:47.000Z","lastModified":"2026-06-17T10:04:47.000Z","status":"Deferred","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.00247,"percentile":0.15932,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I107ab638fecbf52b5bec3f02726ed24b1ae74429","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://gerrit.wikimedia.org/r/q/I2e8c73445172679634f6ec64d37cf82507dfa110","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T394721","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T394721","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-7363","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}