Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Oct 17, 2025Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2025-62508 · Other software · StarCitizenTools · reported by GitHubMedium 6.5
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s textContent when copying button labels. This causes escaped HTML in system message content (such as citizen-share, citizen-view-history, citizen-view-edit, and nstab-talk) to be interpreted as HTML in the sticky header, allowing injection of arbitrary script by a user with the ability to edit interface messages. The vulnerability allows a user with the editinterface right but without the editsitejs right (by default the sysop group has editinterface but may not have editsitejs) to execute arbitrary JavaScript in other users’ sessions, enabling unauthorized access to sensitive data or actions. The issue is fixed in 3.9.0.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2025-53370 · Other software · StarCitizenTools · reported by GitHubHigh 8.6
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2025-53368 · Other software · StarCitizenTools · reported by GitHubHigh 8.6
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2025-49579 · Other software · StarCitizenTools · reported by GitHubMedium 6.5
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2025-49578 · Other software · StarCitizenTools · reported by GitHubMedium 6.5
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2025-49577 · Other software · StarCitizenTools · reported by GitHubMedium 6.5
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2025-49576 · Other software · StarCitizenTools · reported by GitHubMedium 6.5
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2025-49575 · Other software · StarCitizenTools · reported by GitHubMedium 6.5
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2024-47536 · Other software · StarCitizenTools · reported by GitHubMedium 4.8
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2024-36123 · Other software · StarCitizenTools · reported by GitHubMedium 6.5
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.