CVE-2026-100376

A flaw was found in the MediaWiki TemplateSandbox extension. A remote attacker could exploit this vulnerability by enticing a victim into previewing a page configured with a specially crafted sandbox prefix. This flaw can lead to Cross-Site Scripting XSS, enabling the execution of arbitrary scrip...

CVE-2026-100376 TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100376 TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10...