CVE-2013-4307: Multiple cross-site scripting (XSS) vulnerabilities in repo/includes/EntityView.php in the Wikibase extensi...

Security readout for executives and security teams

This flaw lets an attacker place script or HTML into Wikibase entity labels shown in MediaWiki's "In other languages" section. A remote administrator could also inject script through a description. Impact depends on who can edit those fields and who later views the affected pages. Exposure is likely limited to older MediaWiki deployments running the Wikibase extension on the affected 1.19, 1.20, or 1.21 branches. Public or semi-public wiki editing increases concern because labels or descriptions may be viewed by other users. Treat as a patching and exposure review item, not an emergency from the supplied evidence. Prioritize internet-facing or community-editable wiki deployments because stored XSS can affect users who browse trusted pages. Mitigation focus: Upgrade affected MediaWiki branches to 1.19.8, 1.20.7, 1.21.2, or later supported releases.; Confirm the Wikibase extension is updated with the MediaWiki security release guidance.; If immediate upgrade is impossible, restrict who can edit labels and descriptions..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.