Mediawiki Thanks Extension
Monthly
Stored cross-site scripting in the MediaWiki Thanks extension (CWE-79) allows an authenticated user to persist a malicious script payload through a Thanks-related action or field, which then executes in the browser of any victim who later views the affected page or notification. All versions before 1.43.10, 1.45.5, and 1.46.1 are affected, and successful exploitation requires victim interaction with the rendered content; because the injected script executes in the victim's browser session, the CVSS 3.1 base score is 6.1 (Medium) with a scope change, but only low confidentiality and integrity impact and no availability impact. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no; vendor patches are available.
Stored cross-site scripting in the MediaWiki Thanks extension (CWE-79) allows an authenticated user to persist a malicious script payload through a Thanks-related action or field, which then executes in the browser of any victim who later views the affected page or notification. All versions before 1.43.10, 1.45.5, and 1.46.1 are affected, and successful exploitation requires victim interaction with the rendered content; because the injected script executes in the victim's browser session, the CVSS 3.1 base score is 6.1 (Medium) with a scope change, but only low confidentiality and integrity impact and no availability impact. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no; vendor patches are available.