CVE-2026-103046

A flaw was found in the MediaWiki WikiLambda extension. Unsafe string replacements on user-provided HTML in the WikifunctionsFragmentRenderer component allow a remote attacker to conduct stored cross-site scripting XSS attacks. By submitting specially crafted input, an attacker can cause arbitrar...

CVE-2026-103046

The Wikimedia Foundation MediaWiki - WikiLambda extension (versions before 1.46.1 ) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. The root cause is that WikifunctionsFragmentRenderer performs unsafe string replacements on user-provided HTML. No sp...

CVE-2026-103046 WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1...