Description
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.
Remediation
References
Related Vulnerabilities
WordPress Plugin Wordfence Security-Firewall & Malware Scan Multiple Vulnerabilities (5.2.3)
WordPress Plugin Seriously Simple Podcasting Cross-Site Request Forgery (2.16.0)
WordPress Plugin Qtranslate Slug Cross-Site Request Forgery (1.1.18)
WordPress 5.7.x Multiple Vulnerabilities (5.7 - 5.7.10)
WordPress Plugin Bitcoin/Altcoin Faucet Cross-Site Request Forgery (1.6.0)