MediaWiki WikiForum CVE-2026-103444

Exploitation requires an attacker to hold a privileged WikiForum role (CVSS PR:H - consistent with WikiForum forums/categories being administrator-created, so the injectable field is likely an admin/moderator-controlled name or description rather than an arbitrary user post) on a MediaWiki instance that has the WikiForum extension installed and enabled. The attacker stores a script-related HTML payload in that field, and exploitation only completes when a separate victim user subsequently loads the affected forum page (UI:P/UI:R). Limiting factors: high privilege prerequisite, required victim interaction (viewing the page), the AT:P attack requirement in the vendor vector, and the narrow deployment of this optional third-party extension. Only the 'master' branch is listed as affected.

This is a low-priority issue that should be triaged accordingly despite being a memory-safety-adjacent web flaw. The vendor CVSS 4.0 base score is only 1.1, driven by a demanding set of conditions in the vector CVSS:4.0/.../PR:H/UI:P/AT:P - it requires high privileges, passive user interaction, and a specific attack requirement, while impact is limited (VC:L/VI:L/VA:L). This is a classic stored XSS (CWE-80, improper neutralization of script-related HTML tags), which is a genuine injection class but here scoped narrowly. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so the exploitation status is: no public exploit identified at time of analysis (the vector's E:P 'Proof-of-Concept' exploit-maturity value hints a PoC concept may exist, but none is referenced). A tension worth flagging: stored XSS in a user-facing forum extension is often scored PR:L (any posting user), yet the vendor assigned PR:H - this strongly implies the injectable field is an administrator-controlled element (e.g., a forum or category name/description, which in WikiForum are admin-created) rather than an ordinary thread post; verify the exact injection point against the Phabricator/Gerrit patch. Overall this is a high-CVSS-would-be-XSS reduced to genuinely low real-world risk by the privilege and interaction prerequisites plus the niche footprint of the extension.

A privileged WikiForum user (per PR:H, most likely an administrator or forum moderator) creates or edits a forum/category/post field, embedding a script-related HTML payload that is stored without neutralization. When another logged-in user later views the affected forum page, the stored script executes in their browser session in the wiki's origin, potentially stealing session context or performing actions as the victim. No public exploit is identified, though the vector's E:P value suggests a proof-of-concept concept.