- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
- Hall of fame
-
Yes
Recognition is the hall of fame at security.wikimedia.org.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://www.mediawiki.org
Products and areas 11
- AuthManager and the authentication stack, covering login, sessions, password reset, two-factor handling, OAuth and shared-login setups
- File upload and thumbnail generation, which run parsers and external converters over content an untrusted user supplied
- Page protection, revision deletion and oversight, the mechanisms that hide content from users who are otherwise trusted
- ResourceLoader and the JavaScript and CSS delivery path, including site-wide and user-specific scripts
- Special pages, the search interface and the job queue, along with the maintenance scripts that run with shell context
- The action API at api.php and the REST API, both of which expose the same operations as the web interface through a different code path
- The extension and hook interface, plus the extensions bundled with a release tarball
- The installer and the update path, which run with more authority than the running wiki
- The published reporting page asks for any software security bug in MediaWiki through the security address or a Security-flagged Phabricator task, and draws no boundary narrower than the software itself
- The user rights and group permission system, covering every right a group can hold and every check that consults it
- The wikitext parser and everything downstream of it, including templates, parser functions and the sanitisation applied before output reaches a browser
Out of scope (6)
- A fix pushed to Gerrit, which discloses the bug publicly and is ruled out by the reporting instructions
- Content and moderation disputes on Wikipedia or any other wiki, which are an editorial matter rather than a software defect
- Operator configuration, including a wiki that deliberately grants anonymous editing or upload rights
- The reporting page publishes no exclusions list for the software, so nothing is carved out by name. What follows are genuine out-of-scope classes
- Third-party extensions and skins that are not bundled with a MediaWiki release
- Upstream PHP, database engines and image converters, unless MediaWiki's own use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report to the address on the policy page , or open a Phabricator task with the Security dropdown set to "Software security bug"
-
Patches go to Phabricator, never to Gerrit. Every Gerrit patchset is public including drafts, so a fix pushed there publishes the bug before the fix ships
-
The mediawiki and wikipedia handles on HackerOne are external directory profiles with rewards switched off, not programs that accept submissions
-
Say which extensions are loaded and at what version, since a large part of any real deployment's surface is extension code rather than core
Not accepted
-
Third-party extensions and skins that are not bundled with a MediaWiki release
-
Content and moderation disputes on Wikipedia or any other wiki, which are an editorial matter rather than a software defect
-
Operator configuration, including a wiki that deliberately grants anonymous editing or upload rights
-
Upstream PHP, database engines and image converters, unless MediaWiki's own use of them is what makes the issue reachable
-
A fix pushed to Gerrit, which discloses the bug publicly and is ruled out by the reporting instructions
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-14363 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. | Medium 6.9 | 1 Jul 2026 |
| CVE-2026-58517 | Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4. | Medium 6.9 | 1 Jul 2026 |
| CVE-2026-14358 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4. | Medium 6.9 | 1 Jul 2026 |
| CVE-2026-58520 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4. | Medium 6.9 | 1 Jul 2026 |
| CVE-2026-58521 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. | Medium 6.9 | 1 Jul 2026 |
| CVE-2026-8857 | A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | – | 1 Jul 2026 |
| CVE-2026-58032 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | Medium 5.3 | 1 Jul 2026 |
| CVE-2026-58033 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | Medium 5.3 | 1 Jul 2026 |
| CVE-2026-58036 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php. | Low 2.1 | 1 Jul 2026 |
| CVE-2026-58037 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Loggi | – | 1 Jul 2026 |
| CVE-2026-58038 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | – | 1 Jul 2026 |
| CVE-2026-58024 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | Medium 5.1 | 1 Jul 2026 |
| CVE-2026-58025 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | Medium 5.9 | 1 Jul 2026 |
| CVE-2026-58026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | – | 1 Jul 2026 |
| CVE-2026-58027 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | Medium 5.3 | 1 Jul 2026 |
| CVE-2026-58028 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/Permi | – | 1 Jul 2026 |
| CVE-2026-58029 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | Medium 5.3 | 1 Jul 2026 |
| CVE-2026-58030 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | Medium 5.3 | 1 Jul 2026 |
| CVE-2026-13706 | Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php. | – | 1 Jul 2026 |
| CVE-2026-13707 | Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9. | – | 1 Jul 2026 |
| CVE-2026-58031 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0. | – | 1 Jul 2026 |
| CVE-2026-58034 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0. | – | 1 Jul 2026 |
| CVE-2026-58035 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue. | – | 1 Jul 2026 |
| CVE-2026-58518 | Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3. | Medium 6.9 | 1 Jul 2026 |
| CVE-2026-58519 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1. | Medium 6.9 | 1 Jul 2026 |
| CVE-2026-34093 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2. | Low 1.1 | 11 May 2026 |
| CVE-2026-34094 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2. | Low 2.0 | 11 May 2026 |
| CVE-2026-34095 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2. | – | 11 May 2026 |
| CVE-2026-34091 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2. | Medium 5.5 | 11 May 2026 |
| CVE-2026-34092 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2. | Low 2.1 | 11 May 2026 |
| CVE-2026-34090 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2. | Medium 4.8 | 11 May 2026 |
| CVE-2026-34087 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2. | Medium 5.1 | 11 May 2026 |
| CVE-2026-34088 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2. | Low 1.3 | 11 May 2026 |
| CVE-2026-39839 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7. | Medium 6.3 | 7 Apr 2026 |
| CVE-2026-39840 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7. | Medium 5.1 | 7 Apr 2026 |
| CVE-2026-39841 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7. | Medium 6.3 | 7 Apr 2026 |
| CVE-2026-39837 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7. | Medium 6.3 | 7 Apr 2026 |
| CVE-2025-67484 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1. | – | 3 Feb 2026 |
| CVE-2025-67476 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1. | Low 1.3 | 3 Feb 2026 |
| CVE-2025-67477 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1. | – | 3 Feb 2026 |
| CVE-2025-67478 | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1. | – | 3 Feb 2026 |
| CVE-2025-67480 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1. | – | 3 Feb 2026 |
| CVE-2025-67481 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1. | – | 3 Feb 2026 |
| CVE-2025-67483 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1. | – | 3 Feb 2026 |
| CVE-2025-61655 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.4 | – | 3 Feb 2026 |
| CVE-2025-61656 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1. | – | 3 Feb 2026 |
| CVE-2025-61658 | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php. This issue affects CheckUser: from * before 1.43.4, 1.44.1. | Low 1.3 | 3 Feb 2026 |
| CVE-2025-67475 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1. | – | 3 Feb 2026 |
| CVE-2025-61651 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js. This issue affects CheckUser: from * before 1.44.1. | – | 3 Feb 2026 |
| CVE-2025-61646 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. | Low 1.2 | 3 Feb 2026 |
| CVE-2025-61648 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/ShowIPButton.Vue, modules/ext.CheckUser.TempAccounts/SpecialBlock.Js. This issue affects CheckUser: from * before 1.44.1. | – | 3 Feb 2026 |
| CVE-2025-61645 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: from * before 1.44.1. | – | 3 Feb 2026 |
| CVE-2025-11261 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2. | – | 3 Feb 2026 |
| CVE-2025-61638 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1. | – | 3 Feb 2026 |
| CVE-2025-61639 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. | Low 1.7 | 3 Feb 2026 |
| CVE-2025-61640 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. | – | 3 Feb 2026 |
| CVE-2025-61641 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. | Low 1.7 | 3 Feb 2026 |
| CVE-2025-61642 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. | – | 3 Feb 2026 |
| CVE-2025-61643 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. | Low 2.7 | 3 Feb 2026 |
| CVE-2025-61637 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. | – | 3 Feb 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview MediaWiki is the engine under Wikipedia and, by W3Techs count, 72.5% of every wiki engine on the web, including a great deal of corporate and government internal documentation running the same code across 48 million container pulls. The parser is the interesting part: wikitext is a language anonymous users write, on a site whose most privileged accounts render it in their own session, so the trust boundary sits inside the rendering path rather than around it. The Foundation's own program terms state there is no budget for security reports and that no bounties are paid in money or in merchandise. Recognition is a hall-of-fame entry, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The published reporting page asks for any software security bug in MediaWiki through the security address or a Security-flagged Phabricator task, and draws no boundary narrower than the software itself The wikitext parser and everything downstream of it, including templates, parser functions and the sanitisation applied before output reaches a browser The user rights and group permission system, covering every right a group can hold and every check that consults it Page protection, revision deletion and oversight, the mechanisms that hide content from users who are otherwise trusted The action API at api.php and the REST API, both of which expose the same operations as the web interface through a different code path File upload and thumbnail generation, which run parsers and external converters over content an untrusted user supplied AuthManager and the authentication stack, covering login, sessions, password reset, two-factor handling, OAuth and shared-login setups The extension and hook interface, plus the extensions bundled with a release tarball ResourceLoader and the JavaScript and CSS delivery path, including site-wide and user-specific scripts Special pages, the search interface and the job queue, along with the maintenance scripts that run with shell context The installer and the update path, which run with more authority than the running wiki Out of scope The reporting page publishes no exclusions list for the software, so nothing is carved out by name. What follows are genuine out-of-scope classes Third-party extensions and skins that are not bundled with a MediaWiki release Content and moderation disputes on Wikipedia or any other wiki, which are an editorial matter rather than a software defect Operator configuration, including a wiki that deliberately grants anonymous editing or upload rights Upstream PHP, database engines and image converters, unless MediaWiki's own use of them is what makes the issue reachable A fix pushed to Gerrit, which discloses the bug publicly and is ruled out by the reporting instructions Most-valued findings There is no published advisory stream to prioritise from, since the project coordinates through Phabricator rather than GitHub. Priorities below follow the trust boundaries the software actually enforces Anything an anonymous editor can put into wikitext, a template or a parser function that executes in an administrator's session. That is the boundary the whole rendering path exists to hold Permission bypass in the user rights system, above all a path that reveals a deleted or oversighted revision to someone without the right to see it Action API or REST endpoints that skip a right check the equivalent web action enforces, since the two paths reach the same operations Upload and thumbnail handling reaching file write or command execution through the converters MediaWiki shells out to Authentication and session defects across AuthManager, OAuth and shared-login deployments, where a session binds to the wrong account Hook and extension interface defects that are exploitable across many extensions at once rather than in a single one Anything that scales: the same code runs Wikipedia and tens of thousands of private corporate wikis, so a core defect is one finding against every deployment simultaneously Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to [email protected] , or open a Phabricator task with the Security dropdown set to "Software security bug" Patches go to Phabricator, never to Gerrit. Every Gerrit patchset is public including drafts, so a fix pushed there publishes the bug before the fix ships The mediawiki and wikipedia handles on HackerOne are external directory profiles with rewards switched off, not programs that accept submissions Recognition is the hall of fame at security.wikimedia.org. There is no payment to negotiate Say which extensions are loaded and at what version, since a large part of any real deployment's surface is extension code rather than core The published no-bounty language survives in HackerOne's cached copy of the policy. The live mediawiki.org page has since been rewritten and now says nothing either way about payment Disclosure Coordinated with the Wikimedia Foundation security team through Phabricator, with fixes landing in supported MediaWiki releases and in the Wikimedia production branch. The GitHub repository is a read-only Gerrit mirror, so there is no GitHub advisory stream to time an embargo against. Hold the detail until the patched releases are announced. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability