Threat database

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.

The MediaWiki PageTriage extension versions 1.43, 1.45, and 1.46 contain a vulnerability that exposes sensitive information through data queries. This issue is classified under CWE-202, which involves exposure of sensitive information through data queries. The vulnerability has a low severity rating and a CVSS 4.0 score of 1.2. There is no indication of known exploits in the wild or available patches at this time.

A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikbase extension versions 1.43, 1.45, and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, classified as CWE-80. It allows an attacker to inject script code into web pages, potentially impacting users with high privileges who interact with the affected extension. The vulnerability has a low CVSS score of 0.3 and no known exploits in the wild.

A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikistories extension versions 1.43, 1.45, and 1.46. The issue is due to improper neutralization of script-related HTML tags, which can allow script injection in web pages. This vulnerability is identified as CWE-80. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

A reflected cross-site scripting (XSS) vulnerability exists in the MediaWiki ReadingLists extension versions 1.45 and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, which can allow an attacker to inject malicious scripts into web pages. The issue has a low severity rating and a CVSS 4.0 score of 1.1. No official patch or remediation guidance has been provided yet.

CVE-2026-103446 is an authorization bypass vulnerability in the Wikimedia Foundation's MediaWiki WikiLambda extension version 1.46. It involves a user-controlled key that allows authentication bypass, potentially enabling unauthorized access. The vulnerability has a high severity with a CVSS score of 7.4. A patch is available for this issue. The affected product is a cloud service, and the vendor manages remediation for this service.

A stored cross-site scripting (XSS) vulnerability exists in the MediaWiki Page_Forms extension maintained by The Wikimedia Foundation. The flaw is due to improper neutralization of script-related HTML tags, allowing malicious scripts to be stored and executed in the context of affected web pages. This vulnerability affects specific versions 1.43, 1.45, and 1.46 of the extension. The CVSS 4.0 base score is low, indicating limited impact and exploitability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-103444 is a low-severity stored cross-site scripting (XSS) vulnerability in the MediaWiki WikiForum extension maintained by The Wikimedia Foundation. It involves improper neutralization of script-related HTML tags, allowing potentially malicious scripts to be stored and executed in the context of the affected web pages. The vulnerability affects the master branch of the WikiForum extension. No specific affected versions or patch information is provided.

A low-severity cross-site scripting (XSS) vulnerability exists in the MediaWiki Collection (Book) extension versions 1.43, 1.45, and 1.46. The issue involves improper neutralization of script-related HTML tags, allowing XSS targeting non-script elements. This vulnerability could potentially allow an attacker to inject malicious scripts into web pages generated by the affected extension versions.

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

CVE-2026-103044 is a critical XML injection vulnerability, also known as blind XPath injection, in the Mediawiki EasyTimeline extension maintained by The Wikimedia Foundation. This flaw allows attackers to inject malicious XML content, potentially impacting confidentiality, integrity, and availability. The vulnerability affects versions before 1.43.10, 1.45.5, and 1.46.1 of the EasyTimeline extension. It has a high CVSS score of 9.8, indicating severe risk if exploited.

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVE-2026-100237 is a stored cross-site scripting (XSS) vulnerability in the Mediawiki Thanks Extension maintained by The Wikimedia Foundation. It arises from improper neutralization of input during web page generation. This vulnerability affects versions prior to 1.43.10, 1.45.5, and 1.46.1 of the extension. The CVSS score is 6.1, indicating a medium severity issue. Exploitation requires user interaction and can lead to partial confidentiality and integrity impacts but no availability impact.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.