Description
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
Remediation
References
Related Vulnerabilities
CKEditor Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CVE-2021-26272)
WordPress Plugin Spreadsheet Cross-Site Scripting (2.0)
SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2025-53770)
WordPress Plugin Swipe Checkout for Jigoshop Cross-Site Scripting (3.1.0)
ownCloud Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2047)