MediaWiki WikiSEO EUVD-2026-89084

Exploitation requires the WikiSEO extension to be installed and enabled on a MediaWiki instance running a version below 1.46.1 / 1.45.5 / 1.43.10, and requires the attacker to be able to save page content containing WikiSEO SEO/meta directives (i.e. edit rights - unauthenticated only if the wiki allows anonymous editing). The payload is stored, so execution is gated on a victim subsequently viewing the affected page (UI:R); it does not fire automatically. Limiting factors: the Low C/Low I impact ceiling, the dependence on a victim loading the poisoned page, and the need for edit privileges all constrain realistic impact well below a critical/unauthenticated-RCE profile.

This is a genuine but low-urgency issue. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 MEDIUM) describes a network-reachable stored XSS requiring victim interaction, with scope change (S:C, script escaping into the victim's browser context) but only Low confidentiality and integrity impact and no availability impact. All real-world exploitation signals point the same direction and are consistent with each other: SSVC = Exploitation 'none', Automatable 'no', Technical Impact 'partial'; no CISA KEV listing; no EPSS score supplied; and no public exploit code identified. There is no conflict between the signals - CVSS caps this at MEDIUM, and the SSVC framework independently argues against prioritization (no observed exploitation, not automatable, only partial impact). The one metric worth questioning is PR:N: WikiSEO sets SEO/meta-tag output from page content, which typically requires an account with edit rights to persist the payload, so real-world prerequisites may be closer to PR:L than the vendor's PR:N - verify against the deployment's editing/registration policy. Net: a real, patch-worthy defect but not an emergency; prioritize behind internet-exposed, unauthenticated, or actively-exploited findings.

An attacker with the ability to edit a wiki page (or an anonymous editor if the wiki permits unauthenticated edits) inserts a crafted WikiSEO directive whose meta/SEO value is not properly neutralized, so the markup is stored and emitted into rendered page output. When another user - potentially an administrator - later views the affected page, the injected script executes in their browser session (session/cookie theft, actions on their behalf, defacement). No public proof-of-concept exploit has been identified at time of analysis.