MediaWiki Refreshed Skin CVE-2026-103045

Exploitation requires that the installation use the Wikimedia 'Refreshed' skin (a non-default, third-party MediaWiki skin) at a version before 1.46.1 / 1.45.5 / 1.43.10, and that an attacker can save content into the field the skin renders unsafely. Realistic exploitation is LIMITED by: (1) required user interaction - a victim must load the page containing the stored payload (UI:R); (2) edit access - although the vector is PR:N, storing the payload needs some ability to save wiki content, which on edit-restricted wikis means an authenticated editor; (3) deployment scope - only wikis that have installed and enabled the Refreshed skin are affected. Impact is bounded to in-browser script execution (C:L/I:L, no availability impact).

Signals are consistently LOW-to-MODERATE and non-urgent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium) describes a classic stored XSS: network-reachable, low complexity, but requiring victim interaction (UI:R) and yielding only low confidentiality/integrity impact with a scope change into the victim's browser. CISA SSVC reinforces this as non-priority - Exploitation: none (no observed activity), Automatable: no (requires a victim to render the poisoned page), Technical Impact: partial. No EPSS score, no KEV listing, and no public POC were provided, so there is no evidence of exploitation or weaponization: no public exploit identified at time of analysis. The one tension worth flagging is PR:N on a STORED XSS - storing a payload usually needs some edit capability; the vendor rates it unauthenticated, which is defensible on open/anonymous-editable MediaWiki wikis but would effectively require authentication on wikis that restrict editing (verify against your wiki's editing permissions). Net: a legitimate issue to patch on a normal cadence, not an emergency; the dominant real-world factor is that the affected component is a niche skin, sharply limiting the exposed population.

An attacker with the ability to save wiki content (anonymous on open wikis, or a registered editor on restricted ones) injects a crafted payload into a field rendered by the Refreshed skin. When another user - potentially an administrator - later views the affected page, the stored script executes in their browser session under the wiki's origin, enabling session/cookie theft or UI actions on their behalf. No public exploit code or active exploitation is known at time of analysis.