Cross-Site Scripting in Wikimedia Foundation's MediaWiki Collection Extension
CVE-2026-103443

1.1LOW

Key Information:

Vendor: The Wikimedia Foundation
Status: Mediawiki Collection (book) Extension
Vendor: CVE Published:; 30 September 2026

🔔 Create The Wikimedia Foundation Vulnerability Alert

What is CVE-2026-103443?

A vulnerability in the MediaWiki Collection (Book) extension from Wikimedia Foundation allows for improper neutralization of script-related HTML tags. This weakness can lead to Cross-Site Scripting (XSS) attacks, which could affect non-script elements within web pages, posing risks to users and their data. Versions 1.46, 1.45, and 1.43 of the extension are impacted, making it essential for users to assess their systems and apply necessary updates or mitigations.

Affected Version(s)

MediaWiki Collection (Book) extension 1.46

MediaWiki Collection (Book) extension 1.45

MediaWiki Collection (Book) extension 1.43

References

https://phabricator.wikimedia.org/T435822

https://gerrit.wikimedia.org/r/q/I51d973d4ace99fb6e584296...

CVSS V4

Score:

1.1

Severity:

LOW

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

High

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 30, 2026
Vulnerability Reserved
Sep 30, 2026

Credit

Marco Paciaroni (BomboBombone)

CVE-2026-103443 Data

JSON