Cross-Site Scripting Vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension
CVE-2026-100380

5.3MEDIUM

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Wikibase Extension
Vendor
CVE Published:
25 September 2026

What is CVE-2026-100380?

The Mediawiki - Wikibase Extension has a Cross-Site Scripting (XSS) vulnerability due to improper handling of user input during web page generation. This can allow attackers to inject malicious scripts that may execute in the context of a user's browser, compromising user data. The issue is present in versions before 1.46.1, as well as in specific releases such as 1.45.5 and 1.43.10.

Affected Version(s)

Mediawiki - Wikibase Extension * < 1.46.1, 1.45.5, 1.43.10

References

https://phabricator.wikimedia.org/T434549
https://gerrit.wikimedia.org/r/q/I7407f9748d72161ce25ad0b...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Paciaroni (bombobombone)
.