MediaWiki Thanks Extension EUVD-2026-87204

Exploitation requires the MediaWiki Thanks extension to be installed and enabled (it is bundled with MediaWiki but optional), an attacker able to store a malicious payload through a Thanks-related action or field, and - critically - a victim user who subsequently views the page/notification that renders the unescaped value (UI:R). The scope change (S:C) means the payload executes in the victim's browser rather than compromising the server directly. Limiting factors: the need for victim interaction, likely a wiki account to perform the storing action (the CVSS PR:N is questionable given the extension's workflow), and impact confined to browser-context script execution (C:L/I:L, no availability impact). Affected: all versions before 1.43.10, 1.45.5, and 1.46.1.

This is a stored cross-site scripting flaw (CWE-79) in the MediaWiki Thanks extension, rated CVSS 3.1 6.1 (Medium). All exploitation signals point to LOW real-world urgency rather than active priority: SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial', which is fully consistent with a stored-XSS bug that needs a victim to view attacker-influenced content. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows the required user interaction (UI:R - a victim must render the poisoned page) and a scope change (S:C, the injected script runs in the victim's browser context rather than the vulnerable server component), but only Low confidentiality and Low integrity impact and no availability impact - typical of reflected-into-DOM script execution rather than server compromise. One caveat: the vector asserts PR:N (unauthenticated), yet the Thanks extension's normal workflow (sending a 'thank' for an edit/log action) generally requires an account to store content, so on wikis that forbid anonymous actions the practical privilege requirement is likely PR:L - verify the exact injection sink against the Gerrit patch. Overall this is a genuine but low-priority, defense-in-depth fix, not a high-risk emergency.

An attacker with the ability to trigger a Thanks action (or otherwise seed the vulnerable field) stores a crafted payload containing HTML/JavaScript. When another MediaWiki user - potentially an administrator - later loads the page or notification that renders the unescaped value, the script executes in their browser session, enabling session/token theft or actions performed as the victim. Requires victim interaction (viewing the page); no public exploit code is available and SSVC rates exploitation as 'none'.