CVE-2025-53368 - CVE House

Back to Database

Status published High CVE-2025-53368

Citizen is vulnerable to stored XSS attack in the legacy search bar

8.6 CVSS

Vulnerability Description

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53368

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from StarCitizenTools

View All →

Citizen vulnerable to stored XSS in sticky header button messages

Citizen stored XSS vulnerability through short descriptions

Citizen Short Description stored XSS vulnerability through wikitext

TabberNeue vulnerable to Stored XSS through wikitext

Citizen allows stored XSS in menu heading message

Affected Vendor

StarCitizenTools

View all reports →

Affected Software

mediawiki-skins-Citizen

Vulnerable Versions:

>= 1.9.4, < 3.4.0, >= b2bd79196db1153d0bc1bd51a646d957cbdf4aec, < aedbceb3380bb48db6b59e272fc187529c71c8ca

Timeline

Official Publish: July 3rd, 2025

Last Modified: July 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement