This vulnerability (CVE-2026-58032) in MediaWiki is categorized as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting (XSS). It affects multiple versions of MediaWiki before 1.43.9, 1.44.6, 1.45.4, and 1.46.0, specifically in the JavaScript file resources/src/mediawiki.Api/index.js. The CVSS 4.0 base score is 5.3 (medium), with network attack vector, low complexity, no privileges required, and user interaction needed. The vendor has not published an official fix or remediation level yet. No known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected MediaWiki web application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the CVSS score indicates limited impact due to low scope and required user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying any available temporary mitigations recommended by the Wikimedia Foundation once published.