Cross-Site Scripting Vulnerability in Wikimedia Foundation's Mediawiki - Refreshed Skin
CVE-2026-103045

Currently unrated

Key Information:

Vendor: The Wikimedia Foundation
Status: Mediawiki - Refreshed Skin
Vendor: CVE Published:; 29 September 2026

🔔 Create The Wikimedia Foundation Vulnerability Alert

What is CVE-2026-103045?

An improper handling of user input during web page generation in Wikimedia Foundation's Mediawiki - Refreshed Skin allows for the possibility of stored cross-site scripting (XSS). This vulnerability can enable attackers to inject malicious scripts into webpages viewed by users, potentially compromising user data and site integrity. The issue is present in versions of Mediawiki - Refreshed Skin prior to 1.46.1, 1.45.5, and 1.43.10, highlighting the importance of updating affected systems to mitigate associated risks.

Affected Version(s)

Mediawiki - Refreshed skin 0 < 1.46.1, 1.45.5, 1.43.10

References

https://phabricator.wikimedia.org/T268377

issue-tracking

https://gerrit.wikimedia.org/r/c/mediawiki/skins/Refreshe...

mitigation

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 29, 2026
Vulnerability Reserved
Sep 29, 2026

Credit

Daimona

SomeRandomDeveloper

CVE-2026-103045 Data

JSON