CVE-2026-22711

MediumCVSS 6.9

Published: 07/04/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Risk Assessment

The risk is the execution of malicious scripts in the victim's browser, potentially leading to session theft, redirects, or data theft.

Recommendation

Update MediaWiki to versions 1.43, 1.44, or 1.45 with the appropriate patches or apply fixes from the `master` branch.

Original NVD description (English source)

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.