CVE-2025-49576 — Citizen allows stored XSS in search no result messages
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inser…
Published: 2025-06-12 · CVSS: 6.5 · CVSS 3.1
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7