https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-43861.htmlhttps://patchthecve.com/cve/CVE-2025-43861.htmlWed, 17 Jun 2026 09:24:39 +0000MEDIUM 4.4: ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review dialog. A logged-in attacker must change a form field to include a malicious payload. If that same user then opens the "Review Changes" dialohttps://patchthecve.com/cve/CVE-2025-32964.htmlhttps://patchthecve.com/cve/CVE-2025-32964.htmlWed, 17 Jun 2026 09:12:52 +0000MEDIUM 4.6: ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restricted extension would be automatically disabled even if the user did not hold the ManageWiki-restricted right. This issue has been patched in commit 00bebea. A whttps://patchthecve.com/cve/CVE-2025-32956.htmlhttps://patchthecve.com/cve/CVE-2025-32956.htmlWed, 17 Jun 2026 09:12:51 +0000HIGH 8.0: ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace in Special:ManageWiki/namespaces when using a page prefix (namespace name, which is the current namespace you are renaming) with an injection https://patchthecve.com/cve/CVE-2024-47782.htmlhttps://patchthecve.com/cve/CVE-2024-47782.htmlWed, 17 Jun 2026 07:57:44 +0000HIGH 7.6: WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on the wiki farm. However, the special page does not make any effort to escape the wiki name or description. Therefore, if a wiki sets its name ahttps://patchthecve.com/cve/CVE-2024-47781.htmlhttps://patchthecve.com/cve/CVE-2024-47781.htmlWed, 17 Jun 2026 07:57:44 +0000MEDIUM 6.1: CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user can insert arbitrary HTML that is displayed in the request wiki queue when requesting a wiki. If a wiki creator comes across the XSS payload,https://patchthecve.com/cve/CVE-2024-29898.htmlhttps://patchthecve.com/cve/CVE-2024-29898.htmlWed, 17 Jun 2026 07:23:19 +0000MEDIUM 4.9: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the `(read)` permission.https://patchthecve.com/cve/CVE-2024-29883.htmlhttps://patchthecve.com/cve/CVE-2024-29883.htmlWed, 17 Jun 2026 07:23:18 +0000MEDIUM 4.9: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wiki request. This may expose information thttps://patchthecve.com/cve/CVE-2024-25109.htmlhttps://patchthecve.com/cve/CVE-2024-25109.htmlWed, 17 Jun 2026 07:15:31 +0000MEDIUM 6.5: ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requireshttps://patchthecve.com/cve/CVE-2024-25107.htmlhttps://patchthecve.com/cve/CVE-2024-25107.htmlWed, 17 Jun 2026 07:15:31 +0000MEDIUM 4.9: WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used when making the human-readable timestamp for inclusion on the wiki_creation column. This function uses interface messages to translate the nam