CVE-2025-6591 - HTML injection in API action=feedcontributions output from i18n message

HTML injection in API action=feedcontributions output from i18n message

Published Feb 2, 2026

No CVSS score

EPSS 0.45%

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php.

This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
-	affected	<1.39.13, 1.42.7 1.43.2, 1.44.0

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://phabricator.wikimedia.org/T392276

No recorded changes yet.

Sources

Status PUBLISHED

Assigner wikimedia-foundation

Published Feb 2, 2026

Updated Feb 28, 2026

Reserved Jun 24, 2025

Updated Feb 4, 2026

Status Deferred

Modified Jun 17, 2026

Severity n/a

Public date n/a