Cross-Site Scripting Vulnerability in Wikimedia Foundation MediaWiki CommonsMetadata Extension

CVE-2026-103584

What is CVE-2026-103584?

The Wikimedia Foundation MediaWiki CommonsMetadata extension is susceptible to a Cross-Site Scripting vulnerability due to improper neutralization of script-related HTML tags. This flaw permits attackers to inject malicious scripts into web pages viewed by users, which can lead to unauthorized actions, data theft, or compromised user sessions. Affected versions include 1.43, 1.45, and 1.46. It is recommended to update the extension to mitigate this issue and enhance web security. Refer to the official documentation for further details.

References