CVE-2025-21612

High

Published: 06 January 2025

Published

06 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS Score 0.0019 40.5th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-21612 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-15 Information Output Filtering good match

prevent

Directly addresses the core issue by requiring filtering/escaping of user-supplied page names prior to output, preventing XSS payload execution in TabberTransclude.php.

SI-2 Flaw Remediation good match

prevent

Mandates timely remediation of the specific flaw in TabberNeue versions prior to 2.7.2 through patching to the fixed version that adds escaping.

SI-10 Information Input Validation partial match

prevent

Provides input validation for user-supplied page names to reject or sanitize potential XSS payloads before processing in the MediaWiki extension.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

XSS in public-facing MediaWiki extension directly enables remote exploitation of a web application (T1190) with arbitrary JS execution for impacts like session hijacking.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed…

in 2.7.2.

Deeper analysisAI

CVE-2025-21612 is a cross-site scripting (XSS) vulnerability (CWE-79, CWE-80) in the TabberNeue MediaWiki extension, which enables tab creation on wikis. In versions prior to 2.7.2, the TabberTransclude.php file fails to properly escape user-supplied page names during output, allowing an XSS payload embedded in the page name to execute. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), indicating high severity due to its network accessibility and potential for significant confidentiality impact.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required (UI:N). By supplying a malicious page name containing an XSS payload, attackers can inject and execute arbitrary JavaScript in the context of users viewing affected wiki pages, potentially leading to high confidentiality impact such as session hijacking or data theft, alongside low integrity and availability effects.

The vulnerability is addressed in TabberNeue version 2.7.2, where escaping was added to prevent payload execution. Relevant GitHub commits (d8c3db4e5935476e496d979fb01f775d3d3282e6 and f229cab099c69006e25d4bad3579954e481dc566) detail the fix, and the security advisory (GHSA-4x6x-8rm8-c37j) provides further guidance on updating the extension.