CVE-2026-58028

MediumCVSS 5.4

Published: 01/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

An XSS vulnerability in MediaWiki and CentralAuth allows an attacker to inject malicious scripts into a web page generated by the application. The issue affects several source files including ApiFormatBase.php and ApiHelp.php.

Risk Assessment

An attacker can exploit this vulnerability to steal user sessions, redirect users to malicious sites, or perform other actions in the context of their browser.

Recommendation

Immediately update MediaWiki to version 1.46.0, 1.45.4, 1.44.6, or 1.43.9, and CentralAuth to the corresponding versions listed in the description.

Other vulnerabilities in MediaWiki, CentralAuth

CVE-2026-103442High
External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS