Skip to content
OpenAdvisories
Low · 2.3 CVE-2026-22710 EUVD-2026-1816GHSA-wfx5-6vpf-vmpx

Stored XSS through autocomment system messages in Wikibase

Published Jan 8, 2026 · Updated Jan 9, 2026 · Assigned by wikimedia-foundation

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.

Affected products

VendorProductAffectedFixed
The Wikimedia Foundation Mediawiki - Wikibase Extension 1.45, 1.44, 1.43, 1.39 —

Advisories 1

References