Threat database

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.

Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3.

CVE-2026-39936 is a cross-site scripting (XSS) vulnerability in the Mediawiki Score Extension maintained by The Wikimedia Foundation. The vulnerability arises from improper neutralization of input during web page generation, which could allow injection of malicious scripts. This issue has been fixed in the master branch and in release branches for MediaWiki versions 1.43, 1.44, and 1.45. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. There are no known exploits in the wild at this time.

CVE-2026-39935 is a medium severity cross-site scripting (XSS) vulnerability in the CampaignEvents Extension of The Wikimedia Foundation's Mediawiki. It arises from improper neutralization of input during web page generation, allowing injection of malicious scripts. The issue affects versions 1.43, 1.44, 1.45, and 0 of the extension. The vulnerability has been remediated only on the master branch, with no official patch or fix released for the affected versions at the time of this report. There are no known exploits in the wild currently.

CVE-2026-39934 is a medium severity vulnerability in the Wikimedia Foundation's Mediawiki GrowthExperiments Extension. It involves an infinite loop caused by a loop with an unreachable exit condition, which can be leveraged through TOCTOU race conditions. The issue affects multiple versions including 1.43, 1.44, and 1.45. A fix has been applied only on the master branch, but no official patch or remediation level has been confirmed. There are no known exploits in the wild at this time.

CVE-2026-39933 is a cross-site scripting (XSS) vulnerability in the Wikimedia Foundation's Mediawiki GlobalWatchlist Extension. It arises from improper neutralization of input during web page generation. This vulnerability has been fixed in the master branch and in release branches for MediaWiki versions 1.43, 1.44, and 1.45. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No known exploits are reported in the wild.

CVE-2026-39937 is a high-severity vulnerability in The Wikimedia Foundation's Mediawiki CentralAuth Extension involving improper removal of sensitive information before storage or transfer, leading to potential resource leak exposure. The issue affects multiple release branches including MediaWiki versions 1.43, 1.44, and 1.45 and has been remediated on the master branch and these release branches. The vulnerability has a CVSS 4.0 score of 8.8, indicating a significant risk. There are no known exploits in the wild at this time. The vulnerability is not related to a cloud service, and no official remediation level or patch links are provided in the data, but the vendor states the issue is fixed in the specified branches.

CVE-2026-22711 is a medium severity vulnerability in the Wikimedia Foundation's Mediawiki Wikilove Extension involving improper neutralization of alternate cross-site scripting (XSS) syntax. This flaw allows XSS attacks due to insufficient sanitization of input. The issue has been fixed in the master branch and release branches for MediaWiki versions 1.43, 1.44, and 1.45. No known exploits are reported in the wild. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a moderate risk level.

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43.

Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GrowthExperiments Extension: 1.45, 1.44, 1.43, 1.39.

CVE-2026-22714 is a Cross-Site Scripting (XSS) vulnerability found in the Monaco Skin of Mediawiki versions 1.39, 1.43, 1.44, and 1.45 maintained by The Wikimedia Foundation. This vulnerability arises due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The CVSS 4.0 score is 2.3, indicating a low severity level, primarily because exploitation requires user interaction and only impacts confidentiality and integrity to a limited extent. No known exploits are currently reported in the wild.

CVE-2026-22710 is a Cross-Site Scripting (XSS) vulnerability in the Mediawiki Wikibase Extension versions 1.39, 1.43, 1.44, and 1.45. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability has a low CVSS score of 2.3, indicating limited impact and requiring user interaction without authentication. No known exploits are currently reported in the wild. European organizations using affected Mediawiki versions with the Wikibase Extension could face risks of session hijacking or content manipulation if exploited.