Skip to content
OpenAdvisories
High WID-SEC-2026-1043 13 CVEs

MediaWiki Erweiterungen: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Apr 9, 2026 · Updated Apr 9, 2026 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki Extensions ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 13

  • High 8.8
    CVE-2026-39937

    Global vanishing does not completely remove user email

    Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the `master` branch, and in the release branches f…

    The Wikimedia Foundation MediaWiki CentralAuth extension Web / CMS
  • Medium 6.9
    CVE-2026-22711

    Stored XSS through system messages in WikiLove

    Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions…

    The Wikimedia Foundation Mediawiki - Wikilove Extension Web / CMS
  • Medium 6.9
    CVE-2026-39838

    ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and …

    Wikimedia Foundation MediaWiki - ProofreadPage Extension Web / CMS
  • Medium 6.9
    CVE-2026-39933

    Multiple XSS vulnerabilities in GlobalWatchlist

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and i…

    The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension Web / CMS
  • Medium 6.9
    CVE-2026-39934

    Growth Experiments ReassignMenteesJob runs as an infinite loop

    Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue was remediated only on the `master` b…

    The Wikimedia Foundation Mediawiki - GrowthExperiments Extension Web / CMS
  • Medium 6.9
    CVE-2026-39935

    XSS-via-i18n in localised wiki names

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.

    The Wikimedia Foundation Mediawiki - CampaignEvents Extension Web / CMS
  • Medium 6.9
    CVE-2026-39936

    Stored XSS in Score due to usage of non-reserved data attributes

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the rele…

    The Wikimedia Foundation Mediawiki - Score Extension Web / CMS
  • Medium 6.3
    CVE-2026-39837

    Stored XSS through the dynamic table format in Cargo

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

    Wikimedia Foundation Mediawiki - Cargo Extension Web / CMS
  • Medium 6.3
    CVE-2026-39839

    Stored XSS through URLs in Cargo's map format

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

    Wikimedia Foundation Mediawiki - Cargo Extension Web / CMS
  • Medium 6.3
    CVE-2026-39841

    Stored XSS through list fields on Cargo's page values and Special:CargoTables

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

    Wikimedia Foundation Mediawiki - Cargo Extension Web / CMS
  • Medium 5.3
    CVE-2026-5762

    ReportIncident DiscussionTools integration causes slow requests

    Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS. This issue was remediated only on the `master` branch.

    Wikimedia Foundation MediaWiki - ReportIncident Extension Web / CMS
  • Medium 5.1
    CVE-2026-39840

    CSS injection in multiple Cargo display formats

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

    Wikimedia Foundation Mediawiki - Cargo Extension Web / CMS
  • Low 2.0
    CVE-2026-30977

    RenderBlocking has Stored XSS in renderblocking-css with Inline Assets mode

    RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS in renderblocking-css with Inline Assets mode. $wgRenderBlockingInlineAssets = true and editsitecss…

    lihaohong6 RenderBlocking

Revision history

  1. #1

    Initiale Fassung

References