Cross-Site Scripting Vulnerability in Wikimedia MediaWiki - MassMessage Extension
CVE-2026-103050

Currently unrated

Key Information:

Vendor: The Wikimedia Foundation
Status: Mediawiki - Massmessage Extension
Vendor: CVE Published:; 29 September 2026

🔔 Create The Wikimedia Foundation Vulnerability Alert

What is CVE-2026-103050?

A vulnerability in the MediaWiki MassMessage extension allows improper handling of user input, leading to a stored XSS risk. This flaw can enable attackers to inject malicious scripts into web pages viewed by other users. When exploited, the vulnerability can result in the unintended exposure of sensitive information and unauthorized actions performed on behalf of victims. Affected versions include those prior to 1.46.1, as well as 1.45.5 and 1.43.10.

Affected Version(s)

Mediawiki - MassMessage extension 0 < 1.46.1, 1.45.5, 1.43.10

References

https://phabricator.wikimedia.org/T432341

issue-tracking

https://gerrit.wikimedia.org/r/c/1346089

mitigation

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 29, 2026
Vulnerability Reserved
Sep 29, 2026

Credit

SomeRandomDeveloper

CVE-2026-103050 Data

JSON