The vulnerability identified as CVE-2026-100380 is an XSS flaw in the Mediawiki - Wikibase Extension caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that could be executed in the context of users visiting affected pages. The affected versions include all releases before 1.46.1, 1.45.5, and 1.43.10. The CVSS vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability. No known exploits or patches are currently documented.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable Mediawiki Wikibase Extension, potentially leading to session hijacking, defacement, or other client-side impacts. The CVSS metrics suggest a medium severity impact with limited confidentiality, integrity, and availability consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor Wikimedia Foundation advisories for updates and apply patches once available.