{"id":79990,"date":"2025-10-02T00:33:14","date_gmt":"2025-10-02T00:33:14","guid":{"rendered":""},"modified":"2025-10-03T15:49:42","modified_gmt":"2025-10-03T21:49:42","slug":"cve-2025-59839-cross-site-scripting-vulnerability-in-embedvideo-extension-for-mediawiki","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-59839-cross-site-scripting-vulnerability-in-embedvideo-extension-for-mediawiki\/","title":{"rendered":"CVE-2025-59839: Cross-Site Scripting Vulnerability in EmbedVideo Extension for MediaWiki<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2025-59839 is a severe vulnerability affecting the EmbedVideo Extension in MediaWiki’s versions 4.0.0 and prior. This extension is widely used for embedding video clips from various video sharing services into MediaWiki pages. The vulnerability allows an attacker to add arbitrary<\/a> attributes to an HTML element, leading to a stored Cross-Site Scripting (XSS) attack through wikitext. This vulnerability is of grave concern as it opens the potential for system<\/a> compromise and data leakage, which could have dire consequences for any organization using the affected versions of the EmbedVideo Extension.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-59839
\nSeverity: High (8.6 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: Potential system compromise or data<\/a> leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

MediaWiki EmbedVideo Extension<\/a> | 4.0.0 and prior<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability arises due<\/a> to the EmbedVideo Extension’s ability to add arbitrary attributes to an HTML element through wikitext. An attacker can exploit this vulnerability by crafting malicious wikitext that includes harmful attributes. When a user views a page containing this malicious wikitext, the harmful attributes are executed in the user’s browser, leading to a stored XSS<\/a> attack. This could allow the attacker to execute arbitrary scripts in the context of the user’s session, potentially leading<\/a> to unauthorised actions or data theft.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited through a crafted wikitext:<\/p>\n

{{#ev:youtube|}}<\/code><\/pre>\n
This wikitext attempts to embed a YouTube video, but it includes a malicious ‘onerror’ attribute in an image tag. If the image fails to load, the ‘onerror’ attribute triggers, executing the JavaScript alert function and displaying a message box with the text ‘XSS’. In a real-world attack, this benign alert could be replaced with a more malicious script, such as one that steals the user’s session cookies.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview CVE-2025-59839 is a severe vulnerability affecting the EmbedVideo Extension in MediaWiki’s versions 4.0.0 and prior. This extension is widely used for embedding video clips from various video sharing services into MediaWiki pages. The vulnerability allows an attacker to add arbitrary attributes to an HTML element, leading to a stored Cross-Site Scripting (XSS) attack through […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[81],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-79990","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-xss"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t