MediaWiki Wikibase CVE-2026-103439

Exploitation requires an authenticated MediaWiki account with elevated privileges (vendor PR:H) on a wiki that has the Wikbase/Wikibase extension installed and enabled, plus a victim who views the page containing the injected payload (UI:P). Limiting factors: the flaw is not exploitable against unauthenticated visitors as an attacker, needs a privileged contributor to plant the script, depends on the optional Wikibase extension being deployed, and is confined to affected versions 1.46, 1.45, and 1.43; impacts are limited to Low confidentiality/integrity/availability per the vendor.

This is a low-risk, basic Cross-Site Scripting flaw (CWE-80) in the MediaWiki Wikbase (almost certainly 'Wikibase'/Wikidata) extension. The vendor CVSS 4.0 score of 0.3 is exceptionally low, driven by AV:L, AC:H, AT:P (present attack requirement), PR:H (high privileges), UI:P (passive user interaction) and only Low impacts to confidentiality/integrity/availability. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept identified - the vector's E:P (Proof-of-Concept exploit maturity) reflects a theoretical/PoC state rather than active exploitation, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent in pointing to low real-world risk: even for an XSS class bug, the vendor modeled it as requiring elevated privileges plus victim interaction with only limited impact. One notable tension is AV:L: XSS is normally delivered over the network (AV:N) via a crafted wiki page/parameter, so the vendor's local attack-vector choice is questionable and I diverge from it in my own assessment. Bottom line: this is a high-noise, low-priority issue - patch during normal maintenance, not an emergency.

An authenticated MediaWiki user with sufficient privileges on a wiki running the Wikbase/Wikibase extension injects a crafted script-bearing payload into an editable field; when another user views the affected page, the script executes in their browser session. No public exploit code is available, and the vendor models the flaw as requiring elevated privileges plus victim interaction, sharply limiting practical abuse.