An issue exists in the GoogleAnalyticsMetrics extension for MediaWiki up to and including 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
mediawiki mediawiki |
Vulmon