| Package | Affected versions | Patched versions |
|---|---|---|
| citizen | < 2.16.0 | 2.16.0 |
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free