MediaWiki Flow Extension CVE-2026-100238

Requires a MediaWiki installation with the Flow / StructuredDiscussions extension enabled (an optional, now largely deprecated extension - not present on default MediaWiki installs), at a version before 1.46.1, 1.45.5, or 1.43.10. The attacker needs the ability to post content to a Flow discussion board (topics/replies), which on typical wikis means a registered account, though wikis permitting anonymous edits lower this barrier. Exploitation is limited by required victim interaction (UI:R): another user must view the board containing the stored payload for the script to execute; impact is confined to that victim's browser session (C:L/I:L, no availability impact).

This is a moderate-severity stored XSS with signals that consistently point to low-to-moderate real-world priority rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) describes network-reachable, low-complexity injection whose impact is bounded to low confidentiality and integrity in the victim's browser context, with the S:C scope change reflecting that injected script executes outside the extension's own security boundary. CISA's SSVC decision framework corroborates low urgency: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=partial. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this should not be conflated with active exploitation. The one conflicting nuance is the PR:N rating: the vendor rates it unauthenticated, but stored XSS in a Flow discussion board generally requires the ability to post content, which on many MediaWiki deployments requires at least a registered account (anonymous editing is configurable and common, which makes PR:N defensible but deployment-dependent). Overall this is a standard high-ish-CVSS-but-moderate-real-risk web vulnerability: a patch exists, impact is partial, and no exploitation is observed.

An attacker who can post to a MediaWiki Flow (StructuredDiscussions) board submits a discussion topic or reply containing a crafted payload that bypasses output neutralization. When another user - potentially a moderator or administrator - views the board, the stored script executes in their browser session, enabling session/token theft or actions in their context. No public proof-of-concept is identified at time of analysis, and exploitation requires a victim to view the malicious content (UI:R).