Medium severity · published Jun 12, 2025
CVE-2025-49577
Citizen allows stored XSS in preference menu headings
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
mediawiki-skins-Citizen · StarCitizenTools
>= a741639085d70c22a9f49890542a142a223bf981, < 93c36ac778397e0e7c46cf7adb1e5d848265f1bd; >= 2.13.0, < 3.3.1 · source: vendor
CI
Citizen · Starcitizen.tools
before 3.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49577
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49577
Patch
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd
Patch
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a741639085d70c22a9f49890542a142a223bf981
Exploit
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jwr7-992g-68mh
More from mediawiki-skins-Citizen
6.5
CVE-2025-62508
Citizen vulnerable to stored XSS in sticky header button messages
5.4
CVE-2025-53370
Citizen stored XSS vulnerability through short descriptions
5.4
CVE-2025-53368
Citizen is vulnerable to stored XSS attack in the legacy search bar
5.4
CVE-2025-49576
Citizen allows stored XSS in search no result messages
5.4
CVE-2025-49578
Citizen allows stored XSS in user registration date message