CVE-2026-58034

MediumCVSS 4.8

Published: 01/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

An XSS vulnerability in the Wikimedia Foundation CheckUser extension allows an attacker to inject malicious scripts into a page. The issue is located in the Vue module file responsible for the temporary account blocking field.

Risk Assessment

An attacker can steal administrator sessions or modify interface behavior, leading to unauthorized access to user data and system integrity compromise.

Recommendation

Immediately update the CheckUser extension to version 1.46.0 or later, which includes a fix that neutralizes input data.

Other vulnerabilities in CheckUser

CVE-2026-34090High
A vulnerability in CheckUser at the Wikimedia Foundation allows exposure of sensitive information to unauthorized actors. It affects versions from 1.45.0 before 1.45.2.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.