Checkuser
13 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Checkuser, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Checkuser CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 7 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 1 |
| 2026-08 | 0 |
| 2026-09 | 1 |
Severity
How the 13 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High2
- Medium5
- Low1
Latest CVEs
The 13 most recently published vulnerabilities affecting Checkuser.
- CVE-2023-37252An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.3.1
- CVE-2026-58034Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts4.8
- CVE-2026-34090Suggested investigations: Handle suppressed usernames7.5
- CVE-2025-67478Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"8.8
- CVE-2025-61658Special:GlobalContributions shows edits on wikis the viewer doesn't have access to4.3
- CVE-2025-61651i18n XSS through Special:CheckUser CheckUser helper—
- CVE-2025-61648Stored XSS through system messages in CheckUser—
- CVE-2025-61649UserInfoCard: Check that performing user has permission to view log entries for number of past blocks—
- CVE-2025-61650UserInfoCard is vulnerable to message key stored XSS—
- CVE-2025-61647UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rights—
- CVE-2019-16529An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still visible in CheckUser results in violation of MediaWiki's permissions model.5.3
- CVE-2019-18611An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within oversighted edit summaries made available via the MediaWiki API was potentially v...6.5
- CVE-2015-2940Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive u...6.8
Product grouping is registry-driven, with AI assist and human review. How it works