MediaWiki Collection (Book) EUVD-2026-90079

Exploitation requires the MediaWiki Collection (Book) extension to be installed and enabled (versions 1.43, 1.45, or 1.46), an attacker holding at least low-privilege authenticated editing access (PR:L) to inject script-related HTML into a collection/book field, and a separate victim who must actively interact with the rendered page (UI:A). The flaw targets non-script HTML elements only (CWE-80 basic XSS), and the vendor vector's AC:H plus AT:P indicate additional conditions beyond a trivial payload must be met. These factors - authentication, required victim interaction, dependence on the extension being deployed, and constrained non-script injection - substantially limit realistic exploitation.

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The vendor CVSS 4.0 base score is 1.1, driven by high attack complexity (AC:H), a present attack requirement (AT:P), required low-level authentication (PR:L), and mandatory active victim interaction (UI:A), with only Low confidentiality/integrity/availability impact (VC:L/VI:L/VA:L). This is a basic (CWE-80) stored/reflected XSS limited to non-script HTML elements, which constrains the achievable payload. No EPSS score, no CISA KEV listing, and no explicit POC flag were supplied; the CVSS exploit-maturity metric E:P (Proof-of-Concept) hints that a PoC concept may exist, but the input contains no confirmed public exploit, so this should be read as no public exploit identified at time of analysis. There is no SSVC decision data provided. Net: this is a low-CVSS, low-real-risk hardening issue - an authenticated, interaction-gated XSS in a specific MediaWiki extension - not a widespread or automatable threat.

An authenticated low-privilege MediaWiki user with editing rights on a wiki running the Collection (Book) extension injects script-related HTML into a book/collection field that is improperly neutralized. When another user actively interacts with the rendered book/collection page, the injected markup executes in their browser session. No public exploit is confirmed, though the CVSS E:P metric suggests a proof-of-concept may exist.