Cross-Site Scripting Vulnerability in Wikimedia MediaWiki UploadWizard Extension

CVE-2026-0671

What is CVE-2026-0671?

The MediaWiki UploadWizard extension from Wikimedia Foundation exhibits a vulnerability due to improper neutralization of user input during web page generation. This flaw allows attackers to inject malicious scripts into webpages, resulting in potential unauthorized access to sensitive user data. Versions 1.39, 1.43, 1.44, and 1.45 of the extension are affected. Websites utilizing this extension should be aware of this security risk and take necessary precautions.

References