EUVD-2026-89092
GHSA-2rcm-h6cw-xrfr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable stored XSS; PR:N assumes common open-wiki editing (PR:L if editing is restricted); UI:R as a victim must view the page; S:C and C:L/I:L for browser-context script execution.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS.
This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.
AnalysisAI
Stored cross-site scripting (XSS) in the MediaWiki Wikibase Extension allows remote attackers to inject malicious script that is stored on a wiki page and later executed in another user's browser when that page is viewed; the CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1). Affected are Wikibase Extension versions before 1.46.1, 1.45.5, and 1.43.10; exploitation requires user interaction (UI:R) and results in low confidentiality and integrity impact with scope change, not full server compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the attacker to be able to store content in the Wikibase extension - on a typical open MediaWiki/Wikibase wiki this is possible anonymously or with a low-privilege account, but a wiki that restricts editing raises the effective privilege barrier; and (2) a second user to subsequently view the page containing the stored payload (UI:R), so there is no zero-click path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored XSS (CWE-79) in the Wikibase extension for MediaWiki, rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading Wikibase to 1.46.1, 1.45.5, or 1.43.10 as appropriate for the deployed MediaWiki branch; patch availability is confirmed by the vendor and tracked at https://phabricator.wikimedia.org/T432877 with the corresponding Gerrit change at https://gerrit.wikimedia.org/r/q/If871fa7684d42dae057c0517d4a17132cd7aefeb. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mediawiki Wikibase Extension
View allAuthenticated low-privilege users can exploit a deserialization flaw in the MediaWiki Wikibase extension (versions 1.43,
Cross-site scripting (XSS) in the Wikibase extension for MediaWiki allows unauthenticated remote attackers to inject mal
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today