CVE-2026-100245

MediumCVSS 6.1

Published: 29/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

Stored XSS vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows persistent script injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Risk Assessment

The risk includes execution of malicious scripts in user browsers, potentially leading to session theft, account takeover, or spreading malicious content.

Recommendation

Update Mediawiki - Wikibase Extension to version 1.46.1, 1.45.5, or 1.43.10 (or later) to remediate the vulnerability.

Other vulnerabilities in Mediawiki - Wikibase Extension

CVE-2026-100380Medium
The Wikibase extension for MediaWiki contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS