The vulnerability identified as CVE-2026-103051 involves improper neutralization of input in the CentralNotice extension of Mediawiki, leading to stored cross-site scripting (XSS). This flaw allows malicious input to be stored and later executed in the context of users viewing affected pages. The issue affects versions of the CentralNotice extension prior to 1.46.1, 1.45.5, and 1.43.10. No CVSS score or detailed vendor advisory information is provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected Mediawiki CentralNotice pages. This can lead to session hijacking, defacement, or other malicious actions within the user's browser session. However, no information about active exploitation or specific impact scenarios is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade the CentralNotice extension to version 1.46.1, 1.45.5, or 1.43.10 or later once official patches are available. Until then, consider restricting access to the affected extension or applying any recommended temporary mitigations from the vendor.