Mediawiki Massmessage Extension
Monthly
Stored cross-site scripting in the MediaWiki MassMessage extension allows an authenticated user who can submit message content processed by the extension to inject script that executes in the browser session of any user who later views the generated page. Affected deployments are those running the optional MassMessage extension on a branch older than 1.46.1, 1.45.5, or 1.43.10; core MediaWiki without the extension is not impacted. Rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning exploitation requires user interaction (the victim viewing the page) and yields limited confidentiality and integrity impact confined to the victim's browser; no public exploit code has been identified at time of analysis and CISA SSVC records Exploitation=none with Automatable=no.
Stored cross-site scripting in the MediaWiki MassMessage extension allows an authenticated user who can submit message content processed by the extension to inject script that executes in the browser session of any user who later views the generated page. Affected deployments are those running the optional MassMessage extension on a branch older than 1.46.1, 1.45.5, or 1.43.10; core MediaWiki without the extension is not impacted. Rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning exploitation requires user interaction (the victim viewing the page) and yields limited confidentiality and integrity impact confined to the victim's browser; no public exploit code has been identified at time of analysis and CISA SSVC records Exploitation=none with Automatable=no.