Cross-Site Scripting Vulnerability in Wikimedia Foundation MediaWiki's Flow Extension

CVE-2026-100238

What is CVE-2026-100238?

A vulnerability in the MediaWiki - Flow Extension allows for stored Cross-Site Scripting (XSS) attacks due to improper neutralization of input during web page generation. This flaw affects various versions of the extension, significantly compromising the security of applications utilizing this component. Attackers can exploit this vulnerability to inject malicious scripts, potentially leading to data theft, session hijacking, and other malicious activities.

References