Mediawiki Commonsmetadata Extension
Monthly
Cross-site scripting in the MediaWiki CommonsMetadata extension (versions 1.43, 1.45 and 1.46) allows an authenticated editor who can write attacker-controlled content into file/media metadata to plant script-related HTML that executes when another user views the rendered page, giving low confidentiality and integrity impact confined to the victim's browser session. The root cause is CWE-80 (improper neutralization of script-related HTML tags), and the vendor's CVSS v4 score of 1.1 reflects high privileges (PR:H), an attack requirement (AT:P) and passive user interaction (UI:P), with a proof-of-concept-level exploit maturity metric (E:P) rather than any observed attacks. The independent assessment agrees this is a low-priority, low-real-risk issue that requires the optional extension to be installed and a victim to subsequently view the injected page; no CISA KEV listing or other confirmation of active exploitation appears in the available data, and Wikimedia has published both a tracking task and an associated Gerrit change addressing the flaw.
Cross-site scripting in the MediaWiki CommonsMetadata extension (versions 1.43, 1.45 and 1.46) allows an authenticated editor who can write attacker-controlled content into file/media metadata to plant script-related HTML that executes when another user views the rendered page, giving low confidentiality and integrity impact confined to the victim's browser session. The root cause is CWE-80 (improper neutralization of script-related HTML tags), and the vendor's CVSS v4 score of 1.1 reflects high privileges (PR:H), an attack requirement (AT:P) and passive user interaction (UI:P), with a proof-of-concept-level exploit maturity metric (E:P) rather than any observed attacks. The independent assessment agrees this is a low-priority, low-real-risk issue that requires the optional extension to be installed and a victim to subsequently view the injected page; no CISA KEV listing or other confirmation of active exploitation appears in the available data, and Wikimedia has published both a tracking task and an associated Gerrit change addressing the flaw.