The Wikimedia Foundation Mediawiki UploadWizard Extension suffers from an XSS vulnerability caused by improper input neutralization during web page generation. This affects all versions before 1.46.1, including 1.45.5 and 1.43.10. The vulnerability enables cross-site scripting attacks, potentially allowing attackers to execute arbitrary scripts in the context of affected users. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity, with medium overall severity. No known exploits in the wild or vendor patch information are currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the UploadWizard Extension. This may lead to session hijacking, defacement, or other malicious actions affecting user experience and security. The impact is rated medium based on the CVSS vector and the nature of XSS vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the UploadWizard Extension and consider applying any recommended temporary mitigations from the vendor.