The MediaWiki WikiForum extension contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of script-related HTML tags in web pages. This flaw allows an attacker with certain privileges to inject malicious scripts that are stored and later executed in the context of other users viewing the affected pages. The vulnerability is identified as CWE-80 and affects the master branch of the extension. The CVSS 4.0 vector indicates network attack vector, low complexity, partial attack complexity, and low impact on confidentiality, integrity, and availability.

The vulnerability allows stored XSS attacks, which could lead to execution of malicious scripts in users' browsers. However, the CVSS score of 1.1 and the vector details suggest the impact is low, requiring privileges and user interaction, with limited confidentiality, integrity, and availability impact. There are no reports of active exploitation.

No patch or remediation information is provided. Patch status is not yet confirmed — check the Wikimedia Foundation's official advisory or repository for current remediation guidance. Until a fix is available, limit privileges of users who can post content in the WikiForum extension and consider applying any available security configurations or filters to reduce XSS risk.