CVE-2012-4377: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote...

Security readout for executives and security teams

This is an old MediaWiki cross-site scripting issue. A remote user could cause a vulnerable wiki to render attacker-controlled script or HTML through a crafted link to a missing image. Business risk is highest for public or partner-facing wikis, where script execution could affect user trust, sessions, or page integrity. Exposure is likely limited to organizations still operating very old MediaWiki versions, especially internet-facing wikis. Internal wikis still matter if they contain privileged users, sensitive content, or authenticated administrative workflows. Address during legacy platform cleanup unless an affected wiki is public-facing or handles privileged users. Public exposure should raise this to a near-term remediation item. Mitigation focus: Upgrade affected MediaWiki installations to 1.18.5, 1.19.2, or later supported releases.; Check current Wikimedia or distribution vendor guidance for any backported fixes.; Prioritize public-facing and authenticated business-critical wikis first..

Prepared

Jun 12, 2026, 20:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.