MediaWiki ReadingLists EUVD-2026-90201

Requires an authenticated MediaWiki account with access to the ReadingLists extension (PR:L) on affected versions 1.45 or 1.46, AND active user interaction (UI:A): because this is Reflected (not Stored) XSS, the attacker must trick a separate authenticated victim into visiting a specially crafted URL whose parameter is reflected unsanitized into the page. The CVSS 4.0 vector also indicates an attack requirement (AT:P), further limiting reliable exploitation. Exploitation is blocked where the ReadingLists extension is not installed, where the wiki is patched, or where the victim does not follow the malicious link. Impact is confined to the victim's browser session context, not server-side compromise.

This is a low-priority issue despite being network-reachable. The vendor CVSS 4.0 score is 1.1 (Low), and multiple signals reinforce low real-world risk: exploitation is authenticated (PR:L), requires active user interaction (UI:A - a victim must follow an attacker-crafted link since this is Reflected, not Stored XSS), has an attack requirement (AT:P), and all impacts are Low (VC:L/VI:L/VA:L). Exploitation status: no public exploit identified at time of analysis, though the CVSS 4.0 'E:P' (Proof-of-Concept) exploit-maturity value suggests a PoC may exist in the referenced Wikimedia patch/bug tracker. No EPSS score and no CISA KEV listing were provided; absence of KEV plus a Low base score indicates this is not an active-exploitation priority. One inconsistency to note: the vendor's 4.0 vector states VC:L/VI:L/VA:L (a direct low impact to the vulnerable system) whereas classic reflected XSS impact typically manifests in the victim's browser session - I model this as a scope change in CVSS 3.1 terms, which raises my independent 3.1 estimate to ~5.4 (Medium), higher than the vendor's 1.1. The conservative vendor score reflects the heavy chain of preconditions rather than the XSS's technical potency.

An authenticated low-privileged MediaWiki user with access to the ReadingLists extension crafts a URL containing a malicious script payload in a reflected parameter and lures another logged-in user (e.g., an administrator) into clicking it. When the victim's browser renders the unsanitized response, the injected script executes in the victim's session context, enabling session-scoped actions such as theft of CSRF tokens or performing actions as the victim. No public weaponized exploit is identified, though a proof-of-concept is implied by the E:P exploit-maturity metric.