CVE-2026-103050

MediumCVSS 6.1

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

The MassMessage extension for MediaWiki contains a stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Risk Assessment

An attacker can inject malicious script that is stored and executed in other users' browsers, leading to session theft or account takeover. This may compromise the security of the entire MediaWiki installation.

Recommendation

Update the MassMessage extension to version 1.46.1, 1.45.5, 1.43.10 or later. Additionally, implement input filtering mechanisms and monitor for unusual scripts.

Other vulnerabilities in MediaWiki MassMessage

CVE-2024-23176Medium
An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS