Medium severity · published Jul 8, 2025
CVE-2025-7362
MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.
This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Mediawiki - MsUpload extension · Wikimedia Foundation
1.39.x before 1.39.13; 1.42.x before 1.42.7; 1.43.x before 1.43.2 · source: vendor
Affected product
MM
Mediawiki - MsUpload extension
Wikimedia Foundation