MediaWiki SecurePoll Extension User Input JavaScript Injection Vulnerability

A vulnerability exists in the MediaWiki SecurePoll extension, specifically in versions 1.39.X prior to 1.39.13, 1.42.X prior to 1.42.7, and 1.43.X prior to 1.43.2. User-controlled inputs are not properly escaped in VotePage.php (poll option input) and ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names). This flaw allows attackers to inject JavaScript, potentially compromising user sessions under certain conditions.

Impact

Exploitation of this vulnerability could lead to JavaScript injection, allowing attackers to compromise user sessions.