CVE-2025-53369

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-53375.4The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ param CVE-2025-533705.4Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions s CVE-2025-533719.1DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotificatio CVE-2025-533727.5node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaS CVE-2025-533738.9Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the CVE-2025-533744.3Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533756.5Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533768.8Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533776.1WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_depe CVE-2025-533789.8A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthentica CVE-2025-533797.5A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remot CVE-2025-53385.4The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and