What is the CVSS score of CVE-2026-22712?

CVE-2026-22712 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mediawiki are affected by CVE-2026-22712?

CVE-2026-22712 presents moderate security risk rated CVSS 4.3. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22712?

Yes, a public proof-of-concept exploit is available for CVE-2026-22712. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-22712?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Mediawiki CVE-2026-22712

MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2026-01-09 c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Mediawiki Approved Revs

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 12, 2026 - 17:50 vuln.today

Public exploit code

Patch released

Feb 12, 2026 - 17:50 nvd

Patch available

CVE Published

Jan 09, 2026 - 00:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.

AnalysisAI

Improper output encoding in MediaWiki's Approved Revs extension through magic word replacement allows unauthenticated attackers to manipulate input data and conduct content injection attacks. Affected versions 1.39, 1.43, 1.44, and 1.45 are vulnerable to this network-accessible flaw that requires user interaction, and public exploit code exists. A patch is available to remediate the vulnerability.

Technical ContextAI

Classified as CWE-116 (Improper Encoding or Escaping of Output). Affects Approved Revs. Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

More in Mediawiki

View all

CVE-2014-1610 MEDIUM This Month POC

6.0 Jan 30

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is

CVE-2015-8009 CRITICAL Act Now POC

9.8 Jul 25

The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4,

CVE-2023-37303 CRITICAL Act Now POC

9.8 Jun 30

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Rated critical severity (CVSS 9.8), thi

CVE-2022-29906 CRITICAL Act Now POC

9.8 Apr 29

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf

CVE-2022-29904 CRITICAL Act Now POC

9.8 Apr 29

The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQ

CVE-2022-28206 CRITICAL Act Now POC

9.8 Mar 30

An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2022-28205 CRITICAL Act Now POC

9.8 Mar 30

An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2021-36128 CRITICAL Act Now POC

9.8 Jul 02

An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this

CVE-2021-36126 CRITICAL Act Now POC

9.8 Jul 02

An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this

CVE-2017-8809 CRITICAL Act Now

9.8 Nov 15

api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnera

CVE-2024-47849 HIGH This Week POC

8.8 Oct 05

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foun

CVE-2021-36132 HIGH This Week POC

8.8 Jul 02

An issue was discovered in the FileImporter extension in MediaWiki through 1.36. Rated high severity (CVSS 8.8), this vu

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all

CVE-2013-4547 HIGH POC

7.5

CVE-2026-20245 HIGH POC

7.8

CVE-2022-36446 CRITICAL POC

9.8

CVE-2017-8303 CRITICAL POC

9.8

CVE-2022-30781 HIGH POC

7.5

CVE-2023-46301 CRITICAL POC

9.8

CVE-2023-46300 CRITICAL POC

9.8

CVE-2022-41443 CRITICAL POC

9.8

CVE-2026-22712 vulnerability details – vuln.today

Back

Mediawiki CVE-2026-22712

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mediawiki

Same weakness CWE-116 – Improper Encoding or Escaping of Output

Share

External POC / Exploit Code