Mediawiki Refreshed Skin
Monthly
Stored cross-site scripting in the MediaWiki 'Refreshed' skin lets an attacker who can save wiki content plant script that executes in the browser of any user viewing the affected page, affecting all versions before 1.46.1, 1.45.5, and 1.43.10 of this non-default, opt-in third-party skin. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which bounds impact to in-browser script execution - low confidentiality and integrity, no availability - once a victim loads the tainted page. Exposure is limited to wikis that have installed and enabled Refreshed; CISA's SSVC assessment records exploitation as none with partial technical impact, and no public exploit has been identified at time of analysis. Vendor patches are available.
Stored cross-site scripting in the MediaWiki 'Refreshed' skin lets an attacker who can save wiki content plant script that executes in the browser of any user viewing the affected page, affecting all versions before 1.46.1, 1.45.5, and 1.43.10 of this non-default, opt-in third-party skin. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which bounds impact to in-browser script execution - low confidentiality and integrity, no availability - once a victim loads the tainted page. Exposure is limited to wikis that have installed and enabled Refreshed; CISA's SSVC assessment records exploitation as none with partial technical impact, and no public exploit has been identified at time of analysis. Vendor patches are available.