MediaWiki Page Forms CVE-2026-103445

Requires an authenticated MediaWiki account with permission to submit or edit Page Forms content (PR:L), on a wiki running the Page Forms extension version 1.43, 1.45, or 1.46. The payload is stored, so a second victim user must subsequently view the affected page for the script to fire (UI:P/victim interaction). Limiting factors: attacker authentication is mandatory, impact is confined to Low across confidentiality/integrity/availability, the AT:P attack requirement implies non-trivial conditions must hold, and realistic harm depends on a higher-privileged user viewing the poisoned content.

This is a low-real-risk, high-friction stored XSS despite being a memory-safety-adjacent web flaw. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P) scores only 1.2 - driven down by required attacker authentication (PR:L), an attack requirement (AT:P), required victim interaction (UI:P), and uniformly Low technical impacts (VC:L/VI:L/VA:L). No EPSS score is provided and the CVE is NOT in CISA KEV, so there is no public-exploitation-probability signal and no confirmed active exploitation. The E:P (Proof-of-Concept) exploit-maturity metric in the vendor vector hints that exploit knowledge exists, but no public exploit was identified at time of analysis - treat E:P as a maturity estimate, not evidence of a released POC. Net: this is a genuine stored XSS worth patching on a normal cadence, but it is NOT an urgent priority - exploitation requires an authenticated contributor account and a victim who views the poisoned page. One caveat: stored XSS executing in another user's authenticated MediaWiki session can realistically enable session/CSRF-token theft and action-on-behalf, which is arguably underweighted by the vendor's uniform VC/VI/VA:L rating.

An authenticated low-privilege MediaWiki user with edit rights submits a Page Forms form containing script-related HTML tags that the extension fails to neutralize, storing the payload in a wiki page. When another user - potentially an administrator - subsequently views that page, the script executes in their browser under their MediaWiki session. The E:P maturity flag suggests proof-of-concept knowledge exists, but no public exploit code was identified in the provided intelligence.