Description
An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading, pagetriage-filter-set-button, or pagetriage-filter-reset-button message.
Remediation
References
Related Vulnerabilities
RubyGems Improper Verification of Cryptographic Signature Vulnerability (CVE-2018-1000076)
Liferay DXP Inefficient Regular Expression Complexity Vulnerability (CVE-2022-42124)
WordPress Plugin A/B Test 'action' Parameter Directory Traversal (1.0.6)
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4901)
WordPress Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-4340)