Skip to content
OpenAdvisories
Medium · 4.8 CVE-2026-100383 EUVD-2026-87349GHSA-45r6-8hjm-wh6p

Stored i18n XSS in WikiLambda's VisualEditor integration

Published Sep 25, 2026 · Updated Sep 26, 2026 · Assigned by wikimedia-foundation

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS).

This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

Affected products

VendorProductAffectedFixed
Wikimedia Foundation Mediawiki - WikiLambda Extension 1.47.0-alpha —

References