High severity · published Oct 20, 2025
CVE-2025-62697
Improperly sanitized style parameter in LanguageSelector
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Mediawiki - LanguageSelector Extension · The Wikimedia Foundation
master before 1.39 · source: vendor
Affected product
ML
Mediawiki - LanguageSelector Extension
The Wikimedia Foundation