Description
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.
Remediation
References
Related Vulnerabilities
WordPress Plugin Shopping Cart & eCommerce Store Unspecified Vulnerability (3.1.9)
PostgreSQL CVE-2024-10976 Vulnerability (CVE-2024-10976)
WordPress Plugin PWG Random Cross-Site Request Forgery (1.11)
phpMyAdmin Other Vulnerability (CVE-2006-2418)
MediaWiki Resource Management Errors Vulnerability (CVE-2015-6733)