Mediawiki - SecurePoll extension vulnerabilities

3 known vulnerabilities in Mediawiki - SecurePoll extension from Wikimedia Foundation. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Mediawiki - SecurePoll extension: Missing Authorization

  CVE-2025-53485Jul 4, 2025Wikimedia Foundation

  SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue aff

• 9.8 Critical severity

  Mediawiki - SecurePoll extension: Improper Neutralization of Input During Web Page Generation

  CVE-2025-53484Jul 4, 2025Wikimedia Foundation

  User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions.

• 8.8 High severity

  Mediawiki - SecurePoll extension: Cross-Site Request Forgery

  CVE-2025-53483Jul 4, 2025Wikimedia Foundation

  ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site. This issue affects Mediawiki - SecurePoll extension