CVE-2024-23176

MediumCVSS 5.4

Published: 14/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.

Risk Assessment

An attacker could execute arbitrary script in a MediaWiki user's browser, potentially leading to session hijacking or data theft. This affects MediaWiki installations with the MassMessage extension enabled.

Recommendation

Update MediaWiki to version 1.40.2 or later, which contains the fix for this vulnerability.

Other vulnerabilities in MediaWiki MassMessage

CVE-2026-103050Medium
The MassMessage extension for MediaWiki contains a stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Original NVD description (English source)

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS