Mediawiki Wikiseo Extension
Monthly
Stored cross-site scripting in the WikiSEO extension for MediaWiki (all versions before 1.46.1, 1.45.5, and 1.43.10) lets an attacker who can save page content containing WikiSEO SEO/meta directives persist malicious script that runs in the browser of any user who later views the poisoned page. Exploitation is constrained by the need for edit privileges (unauthenticated only on wikis that deliberately allow anonymous editing) and by the requirement that a victim load the affected page, keeping the realistic impact to low confidentiality and integrity effects. No public exploit has been identified at time of analysis and CISA's SSVC framework rates exploitation as 'none'; vendor patches are available, making this a genuine but low-urgency issue.
Stored cross-site scripting in the WikiSEO extension for MediaWiki (all versions before 1.46.1, 1.45.5, and 1.43.10) lets an attacker who can save page content containing WikiSEO SEO/meta directives persist malicious script that runs in the browser of any user who later views the poisoned page. Exploitation is constrained by the need for edit privileges (unauthenticated only on wikis that deliberately allow anonymous editing) and by the requirement that a victim load the affected page, keeping the realistic impact to low confidentiality and integrity effects. No public exploit has been identified at time of analysis and CISA's SSVC framework rates exploitation as 'none'; vendor patches are available, making this a genuine but low-urgency issue.