This vulnerability (CVE-2026-58028) is an instance of CWE-79, improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) in Wikimedia Foundation's MediaWiki and CentralAuth. It affects multiple source files related to API formatting, help, resource loading, page display hooks, and log formatting. The affected versions include all MediaWiki releases before 1.46.0 and specific versions 1.45.4, 1.44.6, and 1.43.9. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to inject malicious scripts into web pages generated by MediaWiki, potentially leading to unauthorized script execution in users' browsers. This can result in session hijacking, defacement, or other client-side attacks. However, no known exploits have been reported, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Wikimedia Foundation advisories for updates. No specific mitigation steps are provided by the vendor at this time.