CVE-2026-100380

MediumCVSS 5.3

Published: 25/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

The Wikibase extension for MediaWiki contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Risk Assessment

An attacker can inject malicious script that executes in the user's browser, potentially leading to session theft or other attacks.

Recommendation

Update the Wikibase extension to version 1.46.1, 1.45.5, 1.43.10 or later.

Other vulnerabilities in MediaWiki Wikibase extension

CVE-2026-100245Medium
Stored XSS vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows persistent script injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS