Is there a patch available for CVE-2026-58028?

Yes, a patch is available for CVE-2026-58028. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58028

EUVD-2026-41029 NONE

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 wikimedia-foundation

GHSA-jqc3-4vrw-8965

PHP XSS Mediawiki Centralauth Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

5.4 MEDIUM

Network-delivered stored XSS requiring authenticated editor (PR:L), victim page load (UI:R), scope change to browser (S:C), with low confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:04 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.

This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Cross-site scripting in Wikimedia Foundation MediaWiki and the CentralAuth extension allows authenticated low-privileged users to inject malicious scripts into rendered wiki pages or API output through unsanitized input in API formatting, ResourceLoader module handling, page display hooks, and permission change log formatting. Affected versions span all releases of both products prior to the 1.46.0, 1.45.4, 1.44.6, and 1.43.9 patch series. No public exploit code or CISA KEV listing has been identified at time of analysis, though the five affected PHP files suggest a broad attack surface across core MediaWiki subsystems.

Technical ContextAI

MediaWiki is a PHP-based wiki engine (CPE: cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:*) powering Wikipedia and thousands of additional wikis. CentralAuth (CPE: cpe:2.3:a:wikimedia_foundation:centralauth:*:*:*:*:*:*:*:*) is a MediaWiki extension providing cross-wiki single sign-on. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled input reaches HTML output without proper encoding or escaping. The five identified PHP files span distinct subsystems: ApiFormatBase.php and ApiHelp.php govern API response formatting and inline API documentation rendering; Module.php is part of the ResourceLoader system that serves JavaScript and CSS bundles; PageDisplayHookHandler.php hooks into the page rendering pipeline; and PermissionChangeLogFormatter.php (in CentralAuth) formats log entries for permission changes - a location frequently involving user-supplied content such as group names or reasons. XSS in a MediaWiki API or log context is typically stored (persisted in the database and rendered to any viewer) rather than reflected, given the nature of these subsystems.

RemediationAI

Upgrade MediaWiki and the CentralAuth extension to one of the patched releases: 1.43.9, 1.44.6, 1.45.4, or 1.46.0 - select the branch matching your current deployment series. The fix details can be tracked via the upstream Phabricator task at https://phabricator.wikimedia.org/T422306. If an immediate upgrade is not feasible, restrict wiki editing permissions to trusted users only to raise the effective attacker privilege bar, as the CVSS PR:L signal indicates the injection requires an authenticated editor role. Disabling open user registration or placing the wiki behind authentication reduces the pool of potential injectors. Disabling or restricting API access (especially the ApiHelp endpoint) for anonymous or untrusted users can reduce one identified attack surface. Note that restricting the ResourceLoader or PageDisplayHookHandler pathways is not practical without disabling core wiki functionality. Apply the upgrade as the primary remediation - compensating controls do not fully neutralize a stored-XSS risk where admin-level users are also potential victims.