This vulnerability (CWE-79) in the Mediawiki Flow Extension allows an attacker to inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The issue stems from improper input sanitization during web page generation. The affected versions include all versions before 1.46.1, 1.45.5, and 1.43.10. No detailed vendor advisory or patch information is available to confirm remediation status.

Successful exploitation could allow an attacker to execute arbitrary scripts in the browsers of users viewing the affected content, potentially leading to session hijacking, defacement, or other malicious actions within the context of the Mediawiki installation. The exact impact depends on the deployment and usage of the Flow Extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, users should consider restricting input or applying temporary input sanitization measures to mitigate stored XSS risks.