MediaWiki MediaSearch CVE-2026-103585

Requires the MediaWiki MediaSearch extension to be installed and enabled (it powers Special:MediaSearch media discovery, commonly on Wikimedia Commons-style wikis). Per the CVSS 4.0 vector, the attacker must be an authenticated user (PR:L) and must satisfy an attack requirement (AT:P), and a victim must passively interact with the crafted content (UI:P) for the script to fire. Limiting factors: exploitation is confined to the browser context of a victim who loads the affected MediaSearch view, impact is Low across confidentiality/integrity/availability, and there is no server-side code execution (S:N). Applies to MediaSearch versions 1.46, 1.45, and 1.43.

This is a low-priority, low-real-risk XSS. The vendor's own CVSS 4.0 base score is 1.2 - near the floor - driven by AT:P (an attack requirement must be met), PR:L (attacker must be an authenticated MediaWiki user), UI:P (passive victim interaction), and only Low impact across all vulnerable- and subsequent-system metrics (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L). The supplemental metrics reinforce low urgency: E:P (proof-of-concept maturity, not attacked-in-the-wild), AU:Y (user interaction assumed), R:U, V:D (diffuse value), and U:Amber. No CISA KEV listing, no EPSS score provided, and no public exploit identified - so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict of concern here; every framework (CVSS, supplemental E:P, absence of KEV) points the same direction: a genuine but minor bug. Note the input provides only a CVSS 4.0 vector, not a 3.1 vector, so any 3.1-based prioritization must be independently derived. CWE-80 (basic XSS via script tags) combined with S:N indicates a contained, non-wormable browser-side flaw rather than a server-compromise vector.

An authenticated MediaWiki user with edit privileges injects unsanitized script-bearing content that is rendered by the MediaSearch extension's UI; when another logged-in user browses that media search result or page, the script executes in their browser session. No public proof-of-concept exploit has been identified, and the CVSS 4.0 vector (PR:L, UI:P, AT:P) means the attacker needs an account and a victim must passively load the affected view under a specific condition.