Mediawiki Wikbase Extension
Monthly
Cross-site scripting in the MediaWiki Wikbase (Wikibase) extension lets a privileged, authenticated contributor inject script-related HTML into wiki content that is subsequently rendered to other users visiting the affected page. The flaw affects installations running the extension on MediaWiki 1.46, 1.45, and 1.43, and requires both an attacker account with elevated rights and a victim who views the crafted page; independent assessment confirms a low-risk, basic XSS (CWE-80) with Low confidentiality, integrity, and availability impact, matching the very low vendor CVSS 4.0 score of 0.3. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting in the MediaWiki Wikbase (Wikibase) extension lets a privileged, authenticated contributor inject script-related HTML into wiki content that is subsequently rendered to other users visiting the affected page. The flaw affects installations running the extension on MediaWiki 1.46, 1.45, and 1.43, and requires both an attacker account with elevated rights and a victim who views the crafted page; independent assessment confirms a low-risk, basic XSS (CWE-80) with Low confidentiality, integrity, and availability impact, matching the very low vendor CVSS 4.0 score of 0.3. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.