This vulnerability in MediaWiki arises from improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting). It affects several core files such as includes/Language/Language.Php and various logging formatter files. The issue allows malicious input to be injected and executed in the context of the web application, potentially leading to XSS attacks. Affected versions include all releases prior to 1.46.0 and specifically 1.45.4, 1.44.6, and 1.43.9. The vendor has not yet provided an official fix or remediation level.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected MediaWiki web application, potentially leading to session hijacking, defacement, or other malicious activities that rely on executing unauthorized scripts in users' browsers. The impact is classified as high severity due to the nature of XSS vulnerabilities and their potential to compromise user interactions with the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published by the Wikimedia Foundation at this time, users should monitor official channels for updates. Until a patch is available, consider applying temporary mitigations such as input validation or output encoding where feasible, but these should be guided by vendor recommendations once available.