Mediawiki Page Forms Extension
Monthly
Stored cross-site scripting in the MediaWiki Page Forms extension (versions 1.43, 1.45, and 1.46) lets an authenticated user who can submit or edit Page Forms content plant script-related HTML that executes in the browser of any other user who later views the affected page. Exploitation is high-friction: the attacker must hold a valid MediaWiki account with form-edit privileges, stored payloads only fire when a second user opens the poisoned page, and the late-breaking CVSS 4.0 score is only 1.2 while our independent assessment rates confidentiality and integrity impact Low with no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); realistic harm depends on luring a higher-privileged user to view the tainted page.
Stored cross-site scripting in the MediaWiki Page Forms extension (versions 1.43, 1.45, and 1.46) lets an authenticated user who can submit or edit Page Forms content plant script-related HTML that executes in the browser of any other user who later views the affected page. Exploitation is high-friction: the attacker must hold a valid MediaWiki account with form-edit privileges, stored payloads only fire when a second user opens the poisoned page, and the late-breaking CVSS 4.0 score is only 1.2 while our independent assessment rates confidentiality and integrity impact Low with no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); realistic harm depends on luring a higher-privileged user to view the tainted page.