The vulnerability identified as CVE-2026-100245 is a stored Cross-site Scripting (XSS) flaw in the Wikimedia Foundation Mediawiki Wikibase Extension. It arises from improper neutralization of input during web page generation, which can allow attackers to inject and store malicious scripts that execute in the context of users viewing the affected pages. The affected versions include all releases before 1.46.1, 1.45.5, and 1.43.10. No detailed CVSS metrics or vendor advisory information is provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users' browsers when they view affected pages. This can lead to session hijacking, defacement, or other malicious actions within the scope of the user's permissions. However, no active exploitation has been reported, and the impact is limited to the affected Mediawiki Wikibase Extension versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Wikimedia Foundation advisories for updates and apply any released patches for the Wikibase Extension promptly. Until a patch is confirmed, consider restricting input sources or sanitizing inputs manually if feasible.