CVE-2024-23176

CVE-2024-23176 is a cross-site scripting (XSS) vulnerability in the MassMessage extension of MediaWiki versions before 1.40.2 . The root cause is that the i18n key massmessage-form-page-help fails to sanitize user-supplied input passed via the uselang parameter in a Special:MassMessage URL (e.g.,...