MediaWiki MassMessage EUVD-2026-89503

Requires the MediaWiki MassMessage extension to be installed and enabled (an optional extension, not part of core MediaWiki), running a version before 1.46.1, 1.45.5, or 1.43.10. The attacker must be able to submit content processed by MassMessage (e.g., message content or delivery list), and a victim user must subsequently view the generated page (UI:R) for the stored script to execute. Limiting factors: exploitation is not automatable (SSVC Automatable=no), impact is confined to the victim's browser session (no server-side code execution or availability impact), and it depends on the non-default deployment of the MassMessage extension.

This is a stored cross-site scripting flaw (CWE-79) in the MediaWiki MassMessage extension, rated CVSS 6.1 (Medium) by the vendor with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. All exploitation signals point to low real-world urgency: SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis. The scope-change (S:C) and network vector inflate the base score relative to actual impact, which is limited to partial confidentiality/integrity (C:L/I:L, A:N) executing in a victim's browser session - typical of reflected/stored XSS rather than server compromise. The UI:R requirement means a victim must view the injected content, so this is not a wormable or drive-by mass-exploitation candidate. A patch is available and confirmed by the Wikimedia Foundation, making remediation straightforward. Net: a legitimate issue to patch on a normal cycle, but not an emergency - the high-ish CVSS is driven by S:C, not by demonstrated exploitability.

An attacker with the ability to submit MassMessage content (message body/spamlist or a related field) stores a malicious script payload that is not properly neutralized during page generation. When a wiki editor or administrator later views the affected page, the script executes in their authenticated browser context, allowing session-scoped actions such as stealing cookies/tokens or performing actions as the victim. No public exploit code is known, and successful exploitation requires the victim to load the poisoned page (UI:R).