Description
An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-invalid-title MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.
Remediation
References
Related Vulnerabilities
WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-5489)
WordPress Plugin Super Forms-Drag & Drop Form Builder Arbitrary File Upload (4.9.700)
MongoDb Out-of-bounds Read Vulnerability (CVE-2017-14227)
WordPress 5.2.x Multiple Vulnerabilities (5.2 - 5.2.17)
Jboss EAP Improper Input Validation Vulnerability (CVE-2010-1871)