Description
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
Remediation
References
Related Vulnerabilities
WordPress Plugin Polldaddy Polls & Ratings Unspecified Vulnerability (2.0.25)
IBM WebSEAL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1886)
WordPress Plugin Simple Ajax Shoutbox SQL Injection (2.2.1)
Liferay Portal Inefficient Regular Expression Complexity Vulnerability (CVE-2022-42124)
MediaWiki Improper Input Validation Vulnerability (CVE-2025-67484)