MediaWiki UploadWizard CVE-2026-100381

Exploitation requires the UploadWizard extension to be installed and enabled on the MediaWiki instance, and requires victim interaction (UI:P) - the attacker cannot trigger script execution without a user viewing or interacting with the crafted upload-flow content. No authentication is needed to introduce the payload (PR:N), but the interaction requirement and the extension-specific attack surface meaningfully limit realistic exploitation. Affected only in versions before 1.46.1, 1.45.5, and 1.43.10.

This is a genuine but low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) describes a network-reachable, low-complexity, unauthenticated XSS that nevertheless requires victim interaction (UI:P) and yields only low impact across confidentiality and integrity (VC:L/VI:L, VA:N), with a low subsequent-system impact (SC:L/SI:L) reflecting the browser scope change typical of XSS. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data in the input. All signals are internally consistent - a moderate-severity (5.3), interaction-gated XSS in a MediaWiki extension. This is not a widespread-exploitation threat; treat it as routine patching hygiene rather than an emergency. The main uncertainty is whether the XSS is stored or reflected, which the description does not specify.

An unauthenticated attacker crafts a malicious payload delivered through the UploadWizard upload flow (e.g., in a field rendered during page generation) and lures a victim to view or interact with the affected page. When the victim's browser processes the unneutralized input, attacker-controlled script executes in the wiki's origin, enabling session/action abuse in the victim's context. No public proof-of-concept was reported.