CVE-2025-59839 HIGH

CVE-2025-59839: Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

Vendor Starcitizenwiki
Product mediawiki-extensions-EmbedVideo
Weakness CWE-79 · XSS
Published September 25, 2025
Last update September 25, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.

Key dates

02Disclosure timeline

September 25, 2025 CVE published
September 25, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-25786 WordPress Eyes Only: User Access Shortcode Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS) CVE-2021-24782 Flex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-Scripting CVE-2023-2999 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq CVE-2025-27088 Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxy CVE-2025-25078 WordPress Google Earth Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability