Mediawiki Flow Extension
Monthly
Stored cross-site scripting in the MediaWiki Flow (StructuredDiscussions) extension lets a user who can post content to a Flow discussion board inject script that executes in the browser of any other user who later views that board. The flaw affects installations running the extension at versions before 1.46.1, 1.45.5, and 1.43.10; Flow is an optional, largely deprecated extension and is not present on a default MediaWiki install. No public exploit code has been identified and CISA's SSVC assessment records no exploitation, so this is a moderate-severity, low-to-moderate-priority issue, with vendor patches already available.
Stored cross-site scripting in the MediaWiki Flow (StructuredDiscussions) extension lets a user who can post content to a Flow discussion board inject script that executes in the browser of any other user who later views that board. The flaw affects installations running the extension at versions before 1.46.1, 1.45.5, and 1.43.10; Flow is an optional, largely deprecated extension and is not present on a default MediaWiki install. No public exploit code has been identified and CISA's SSVC assessment records no exploitation, so this is a moderate-severity, low-to-moderate-priority issue, with vendor patches already available.