Cross-Site Scripting Vulnerability in Wikimedia Foundation Mediawiki - Thanks Extension

CVE-2026-100237

What is CVE-2026-100237?

A vulnerability in the Wikimedia Foundation's Mediawiki - Thanks Extension allows for the improper neutralization of input during web page generation, enabling stored cross-site scripting (XSS). This issue impacts versions prior to 1.43.10, 1.45.5, and 1.46.1. An attacker can exploit this vulnerability to inject malicious scripts, potentially compromising user data and session information. It highlights the importance of secure coding practices and input validation in web applications.

References