CVE-2026-100243 describes a stored XSS vulnerability in the Mediawiki WikiSEO Extension maintained by the Wikimedia Foundation. The vulnerability arises from improper input sanitization during web page generation, classified under CWE-79. This allows an attacker to inject malicious scripts that persist in the application and execute when viewed by other users. The affected versions include all versions prior to 1.46.1, 1.45.5, and 1.43.10. No patch or vendor advisory details are currently available.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of users viewing affected Mediawiki pages, potentially leading to session hijacking, defacement, or other malicious actions within the scope of the user's privileges. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any available updates to the WikiSEO Extension and follow best practices for input validation and output encoding in Mediawiki configurations.