UBUNTU-CVE-2026-103045

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103045

The MediaWiki Refreshed skin is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to improper sanitization of user-supplied input before web page rendering. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10 . A remote attacker can inject malicious scripts into persistent con...

EUVD-2026-89092

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100238

The Wikimedia Foundation Mediawiki - Flow Extension is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the flow colon-separator and flow-guidedtour-optin-welcome-description messages allow for the injection of malic...

CVE-2026-100238 Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103047: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103045: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10...

PT-2026-102673

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100238: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100381

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100383 Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100380

The Wikimedia Foundation Mediawiki - Wikibase Extension is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. Specifically, the issue exists within the Special:SetLabel language validation component. This vulnerability aff...

CVE-2026-100380

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100378 Missing permission check in the Translate sandbox doRemind action

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from before 1.46.1, 1.45.5, 1.43.10...

EUVD-2026-87204

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from before 1.43.10/1.45.5/1.46.1...

CVE-2026-100237

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from before 1.43.10/1.45.5/1.46.1...

CVE-2026-100383: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

CVE-2026-100382: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...

CVE-2026-100380: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...