Mediawiki Wikistories Extension
Monthly
Cross-site scripting in the optional MediaWiki Wikistories extension (versions 1.46, 1.45 and 1.43) allows an attacker who can supply story content to embed script-related HTML tags that the extension fails to neutralize, so the injected markup executes in the browser of a victim who views the crafted story. The flaw is reachable only on MediaWiki installations that have explicitly installed and enabled the Wikistories extension - it is not part of a default MediaWiki deployment - and the vendor's CVSS 4.0 vector describes exploitation requiring high privileges (PR:H), victim interaction (UI:P) and an active-attack condition (AT:P), which sharply limits realistic exposure; there is no public exploit identified at time of analysis and impact is confined to low confidentiality, integrity and availability. The vendor-published CVSS 4.0 score is 0.3, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) rates this a low-real-risk issue despite being an XSS-class flaw.
Cross-site scripting in the optional MediaWiki Wikistories extension (versions 1.46, 1.45 and 1.43) allows an attacker who can supply story content to embed script-related HTML tags that the extension fails to neutralize, so the injected markup executes in the browser of a victim who views the crafted story. The flaw is reachable only on MediaWiki installations that have explicitly installed and enabled the Wikistories extension - it is not part of a default MediaWiki deployment - and the vendor's CVSS 4.0 vector describes exploitation requiring high privileges (PR:H), victim interaction (UI:P) and an active-attack condition (AT:P), which sharply limits realistic exposure; there is no public exploit identified at time of analysis and impact is confined to low confidentiality, integrity and availability. The vendor-published CVSS 4.0 score is 0.3, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) rates this a low-real-risk issue despite being an XSS-class flaw.