CVE-2025-49578 — Citizen allows stored XSS in user registration date message
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing an…
Published: 2025-06-12 · CVSS: 6.5 · CVSS 3.1
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7