Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-0670 EUVD-2026-1167GHSA-m5v6-566h-wgcg

Stored XSS through a system message and a user-provided parameter in ProofreadPage

Published Jan 7, 2026 · Updated Jan 7, 2026 · Assigned by wikimedia-foundation

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39.

Affected products

VendorProductAffectedFixed
Wikimedia Foundation MediaWiki - ProofreadPage Extension 1.45, 1.44, 1.43, 1.39 —

Advisories 1

References