MediaWiki UploadWizard Extension vulnerabilities

3 known CVE vulnerabilities in MediaWiki UploadWizard Extension, translated and rated.

CVE-2026-100381Medium
The UploadWizard extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects versions from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-0671Medium
The UploadWizard extension for MediaWiki (versions 1.45, 1.44, 1.43, 1.39) contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker could inject malicious script code that executes in the user's browser.
CVE-2025-62663Medium
The UploadWizard extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS