EUVD-2026-90210
GHSA-9jgx-vg2f-mrmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to wiki with Wikistories enabled
-
DeliveryInject script-related HTML into story content
-
ExploitVictim renders malicious story
-
ExecutionScript executes in victim browser context
-
ImpactSession/token theft or UI manipulation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization HTML tag escaping
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a MediaWiki installation with the optional Wikistories extension installed and enabled (versions 1.46, 1.45, or 1.43) - it is not part of a default MediaWiki install. Per the vendor CVSS 4.0 vector, exploitation requires high privileges (PR:H), user interaction from the victim viewing the crafted story (UI:P), and carries an active-attack requirement (AT:P), all of which sharply limit realistic exploitation; impact is limited to Low confidentiality/integrity/availability. The injection vector is story content containing script-related HTML tags that the extension fails to neutralize. |
| Impact | This is a low-real-risk issue despite being an XSS-class flaw. The vendor's own CVSS 4.0 vector scores it just 0.3 using an unusually conservative combination (AV:L/AC:H/AT:P/PR:H/UI:P with only Low VC/VI/VA), which is atypical for web XSS - most stored/reflected XSS in a MediaWiki extension is network-reachable (AV:N) and needs at most a low-privileged account. If the vendor's AV:L/PR:H is accurate, exploitation requires local access plus high privileges, making it near-negligible; however that vector likely reflects a very narrow, hard-to-reach injection point rather than the general XSS attack surface, so treat the AV:L/PR:H rating with caution and verify with the Wikimedia patch (gerrit Iad1281). There is no public exploit identified at time of analysis, no EPSS score provided, and no CISA KEV listing; the vendor's E:P (Proof-of-Concept) exploit-maturity flag suggests a reproducer may exist internally but no weaponized code is public. Net: a genuinely low-priority, patch-in-normal-cycle finding, not an urgent one. |
| Exploit ScenarioDerived | An attacker with an account on a wiki running the Wikistories extension crafts a story containing script-related HTML tags that are not properly neutralized; when another user views the story, the injected script executes in their browser session in the wiki's origin. No public exploit code is available, and the vendor's conservative CVSS vector (high privileges, passive user interaction, active-attack requirement) implies the injectable path is narrow and hard to reach in practice. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Cross-site scripting in the optional MediaWiki Wikistories extension (versions 1.46, 1.45 and 1.43) allows an attacker who can supply story content to embed script-related HTML tags that the extension fails to neutralize, so the injected markup executes in the browser of a victim who views the crafted story. The flaw is reachable only on MediaWiki installations that have explicitly installed and enabled the Wikistories extension - it is not part of a default MediaWiki deployment - and the vendor's CVSS 4.0 vector describes exploitation requiring high privileges (PR:H), victim interaction (UI:P) and an active-attack condition (AT:P), which sharply limits realistic exposure; there is no public exploit identified at time of analysis and impact is confined to low confidentiality, integrity and availability. The vendor-published CVSS 4.0 score is 0.3, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) rates this a low-real-risk issue despite being an XSS-class flaw.
RemediationAI
Upstream fix available (Gerrit change Iad1281879723eba73e4338a00d5ff35c6eed0c3e, tracked under Phabricator T182213); a released patched extension version is not independently confirmed in the available data, so administrators should check the Phabricator task and Gerrit change, take the patched 1.43/1.45/1.46 branch revision or the next tagged Wikistories release, and verify the sanitization change is present before assuming closure. Where upgrading cannot be done immediately, the strongest compensating control is to disable or uninstall the Wikistories extension (remove the wfLoadExtension('Wikistories') line from LocalSettings.php or drop the extension directory) - the trade-off is complete loss of the stories feature, which is acceptable because it is a non-core, optional add-on. Alternatively, restrict the right to create or edit stories (for example via the extension's edit/story permissions and MediaWiki group rights) so only trusted, small user groups can author story content, which reduces but does not eliminate the stored-XSS path if those trusted accounts are compromised; combined with this, review existing story content for script tags, event handlers or javascript: URIs and purge or re-save the affected pages, and deploy a Content-Security-Policy header as defense in depth, noting CSP can break legitimate on-wiki gadget and inline-script behavior. Because exploitation additionally requires victim interaction (a user must open the crafted story) and per the vendor vector elevated privileges, monitoring for unusual story edits by accounts with elevated rights is a reasonable detection measure while patching proceeds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-80, improper neutralization of script-related HTML tags in a web page, the classic stored/reflected cross-site scripting class in which user-controllable content is emitted into HTML without escaping or an allow-list-based sanitizer. The affected component is the Wikistories extension, a MediaWiki add-on that lets editors compose 'stories' - sequences of annotated images/media cards - whose content is stored and later re-rendered for other users; the extension's output path evidently accepts script-capable tags such as <script>, event handlers or javascript: URLs inside story content rather than sanitizing them through MediaWiki's usual HTML escaping helpers or the Sanitizer/RemexHtml pipeline. Because Wikistories is distributed separately from MediaWiki core, the vulnerable code exists only where an administrator has installed and enabled the extension; the CPE cpe:2.3:a:the_wikimedia_foundation:mediawiki_wikistories_extension:*:*:*:*:*:*:*:* identifies the extension as the affected product with an unconstrained version range in NVD's configuration. The public record is sparse: the issue is tracked in Wikimedia's Phabricator task T182213 and an associated Gerrit change (Iad1281879723eba73e4338a00d5ff35c6eed0c3e), and the ENISA EUVD entry EUVD-2026-90210 mirrors the same three affected branches (1.46, 1.45, 1.43). Note the scoring divergence: the vendor's CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L) yields 0.3 and assumes an attacker who already holds elevated wiki privileges plus an active attack scenario, whereas the 3.1 assessment used network attack, low complexity and low privileges with changed scope; the exploitability prerequisites, not the score, are the controlling factor here.
Know when Mediawiki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
Web-delivered XSS in a MediaWiki extension is network-reachable and typically needs only a low-privileged editing account (PR:L), requires victim rendering (UI:R), and crosses into the victim's browser context (S:C) with limited C/I impact.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
DescriptionCVE.org
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4,
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Rated critical severity (CVSS 9.8), thi
The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf
The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQ
An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely
An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this
An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnera
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foun
An issue was discovered in the FileImporter extension in MediaWiki through 1.36. Rated high severity (CVSS 8.8), this vu
Exploit-DB