CVE-2020-27620

—

CVSS 3.1

6.1 medium

EPSS

1%p64

Published

Oct 22, 2020 (Oct 22, 2020)

Modified

Jun 17, 2026

Description

The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.

Vendors: mediawiki
Products: skin\
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.