The Wikimedia Foundation Mediawiki Flow Extension contains a stored XSS vulnerability caused by improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The vulnerability affects all versions of the Flow Extension before 1.46.1, 1.45.5, and 1.43.10. No information about active exploitation or patch availability is provided in the input data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to session hijacking, defacement, or other malicious actions within the affected Mediawiki environment. The exact impact depends on the deployment and usage of the Flow Extension but is consistent with typical stored XSS risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the Wikimedia Foundation's security advisories for updates and apply any official patches when available. Until then, consider applying temporary mitigations such as input validation or output encoding if feasible.