CVE-2026-100245 is a stored cross-site scripting (CWE-79) vulnerability in the Wikimedia Foundation's Mediawiki - Wikibase Extension. The vulnerability arises from improper neutralization of input during web page generation, which can allow an attacker to inject malicious scripts that are stored and subsequently executed in the context of users viewing the affected pages. The affected versions include all versions before 1.46.1, 1.45.5, and 1.43.10. No vendor advisory or patch information is provided in the input data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting affected Mediawiki pages, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. However, no information about active exploitation or specific impact scenarios is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the Wikimedia Foundation's advisories for updates and apply any official fixes once available. Until then, consider applying any recommended temporary mitigations from the vendor if published.