The Mediawiki CirrusSearch extension contains a reflected XSS vulnerability due to improper input neutralization during web page generation. This flaw allows attackers to inject and execute arbitrary scripts in the victim's browser when they visit a crafted URL or page. The vulnerability affects all versions of the CirrusSearch extension up to 1.46.0 inclusive. No vendor advisory or patch information is provided in the input data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions limited to the user's browser context. The CVSS score of 5.5 indicates a medium impact with network attack vector, low complexity, and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of the Mediawiki CirrusSearch extension should monitor the Wikimedia Foundation's advisories for updates. Until a fix is available, consider applying temporary mitigations such as input validation or disabling the extension if feasible.