This vulnerability (CVE-2026-100380) in the Mediawiki - Wikibase Extension is due to improper neutralization of input during web page generation, leading to Cross-Site Scripting (CWE-79). It affects all versions before 1.43.10, 1.45.5, and 1.46.1. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low to limited impact on confidentiality, integrity, and availability. No vendor advisory or patch links are provided, so patch status is not confirmed.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected web application, potentially leading to session hijacking or other user-targeted attacks. However, the impact is limited as indicated by the CVSS vector, with low confidentiality and integrity impact and no availability impact. No known exploits are currently reported.

Patch status is not yet confirmed — check the Wikimedia Foundation vendor advisory for current remediation guidance. Until a fix is confirmed, users should be cautious with untrusted input and consider applying any available updates or workarounds provided by the vendor.