Threat database

A Cross-Site Scripting (XSS) vulnerability exists in the Wikimedia Foundation Mediawiki UploadWizard Extension. This vulnerability is due to improper neutralization of input during web page generation, allowing potential injection of malicious scripts. It affects versions prior to 1.46.1, as well as specifically versions 1.45.5 and 1.43.10. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-100380 is a Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation's Mediawiki - Wikibase Extension. It involves improper neutralization of input during web page generation, which could allow attackers to inject malicious scripts. The vulnerability affects versions prior to 1.43.10, 1.45.5, and 1.46.1. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-100379 is a medium severity vulnerability in the Wikimedia Foundation's Wikipedia Android App that allows unauthorized actors to access, intercept, or modify HTTP cookies. This exposure of sensitive information could potentially lead to privacy issues or session hijacking. No specific affected versions or patches are currently detailed.

CVE-2026-100378 is a missing authorization vulnerability in the Wikimedia Foundation's Mediawiki Translate Extension. It allows access to functionality that is not properly constrained by access control lists (ACLs). The issue affects versions before 1.46.1, as well as specifically versions 1.45.5 and 1.43.10. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-100376 is a Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation's Mediawiki TemplateSandbox Extension. It involves improper neutralization of input during web page generation, which can lead to XSS attacks. The vulnerability affects versions before 1.46.1, specifically including 1.45.5 and 1.43.10. The CVSS 4.0 base score is 4.8, indicating a medium severity level.

CVE-2026-100377 is a medium-severity vulnerability in the Wikimedia Foundation's Mediawiki WikiLambda Extension version 1.47.0-alpha. It involves exposure of sensitive information to unauthorized actors. The issue has been fixed in the master branch of the codebase. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network-exploitable flaw with low complexity and no required privileges or user interaction.

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVE-2026-100237 is a stored cross-site scripting (XSS) vulnerability in the Mediawiki Thanks Extension maintained by The Wikimedia Foundation. It arises from improper neutralization of input during web page generation. This vulnerability affects versions prior to 1.43.10, 1.45.5, and 1.46.1 of the extension. The CVSS score is 6.1, indicating a medium severity issue. Exploitation requires user interaction and can lead to partial confidentiality and integrity impacts but no availability impact.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.