Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.39.13, 1.42.x prior to 1.42.7 or 1.43.x prior to 1.43.2. It is, therefore, affected by a number of vulnerabilities as follows.

- Failure to escape the newpage message in FeedUtils enabling XSS attacks. (CVE-2025-32072)

- BlockList discloses rows containing suppressed users. (CVE-2025-6589)

- Failure to escape usernames in HTMLUserTextField validation errors enabling XSS attacks. (CVE-2025-6590)

- Failure to escape i18n messages in the action=feedcontributions API enabling XSS attacks. (CVE-2025-6591)

- Account creation links a temporary username/IP with the real username. (CVE-2025-6592)

- IP address leak to an unverified email. (CVE-2025-6593)

- Reflected XSS in apisandbox when an invalid 'format' value is provided. (CVE-2025-6594)

- Stored XSS through system messages in MultimediaViewer. (CVE-2025-6595)

- Vector inserts portlet labels as HTML, allowing stored XSS. (CVE-2025-6596)

- Autocreation is treated as a login for reauthentication. (CVE-2025-6597)

- Extensions are unable to suppress the reauth flag on login. (CVE-2025-6926)

- Autoblocks visibility and hidden username leaks. (CVE-2025-6927)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability     in Wikimedia Foundation Vector. This vulnerability is associated with program files     resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects     Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0. (CVE-2025-6596)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115340	MediaWiki 1.43.x < 1.43.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115339	MediaWiki 1.42.x < 1.42.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115338	MediaWiki < 1.39.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
249371	Linux Distros Unpatched Vulnerability : CVE-2025-6596	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-6596

info

Tenable Plugins

medium

medium

medium

medium