Mediawiki Collection Book Extension
Monthly
Cross-site scripting (XSS) in the MediaWiki Collection (Book) extension affects versions 1.43, 1.45, and 1.46 and allows an authenticated low-privilege editor to inject script-related HTML into collection/book fields, which then executes when a separate victim interacts with the rendered page. The flaw targets non-script HTML elements (CWE-80), and exploitation is constrained by the requirement that the extension be installed and enabled, by the attacker needing editing access, and by mandatory victim interaction; the vendor assigns CVSS v4 base score 1.1 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/E:P). The supplied CVSS v4 vector's E:P metric indicates that publicly available exploit code exists, but there is no CISA KEV listing, and our independent CVSS v3.1 assessment (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) agrees this is low priority.
Cross-site scripting (XSS) in the MediaWiki Collection (Book) extension affects versions 1.43, 1.45, and 1.46 and allows an authenticated low-privilege editor to inject script-related HTML into collection/book fields, which then executes when a separate victim interacts with the rendered page. The flaw targets non-script HTML elements (CWE-80), and exploitation is constrained by the requirement that the extension be installed and enabled, by the attacker needing editing access, and by mandatory victim interaction; the vendor assigns CVSS v4 base score 1.1 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/E:P). The supplied CVSS v4 vector's E:P metric indicates that publicly available exploit code exists, but there is no CISA KEV listing, and our independent CVSS v3.1 assessment (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) agrees this is low priority.