CVE-2026-100381

MediumCVSS 5.3

Published: 25/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

The UploadWizard extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Risk Assessment

The risk includes the possibility of executing malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or other attacks.

Recommendation

It is recommended to update the UploadWizard extension to version 1.46.1, 1.45.5, or 1.43.10, which include the fix.

Other vulnerabilities in MediaWiki UploadWizard Extension

CVE-2025-62663Medium
The UploadWizard extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS