Mediawiki Wikiforum Extension
Monthly
Stored cross-site scripting (XSS) in the MediaWiki WikiForum extension allows an authenticated attacker holding a privileged forum role to plant script-related HTML that executes in the browser of any user who later views the manipulated forum page. The flaw is rooted in improper neutralization of script-related HTML tags (CWE-80) within WikiForum-managed fields on the master branch, and successful exploitation demands both elevated WikiForum permissions and victim interaction, which is why the vendor assigns it a very low CVSS 4.0 score of 1.1 and the independent assessment treats it as a low-priority issue. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (not in CISA KEV), so the practical risk is primarily limited to wiki instances that run this optional extension.
Stored cross-site scripting (XSS) in the MediaWiki WikiForum extension allows an authenticated attacker holding a privileged forum role to plant script-related HTML that executes in the browser of any user who later views the manipulated forum page. The flaw is rooted in improper neutralization of script-related HTML tags (CWE-80) within WikiForum-managed fields on the master branch, and successful exploitation demands both elevated WikiForum permissions and victim interaction, which is why the vendor assigns it a very low CVSS 4.0 score of 1.1 and the independent assessment treats it as a low-priority issue. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (not in CISA KEV), so the practical risk is primarily limited to wiki instances that run this optional extension.