XSS Vulnerability in Wikimedia Foundation's MediaWiki MediaSearch Extension
CVE-2026-103585

1.2LOW

Key Information:

Vendor: The Wikimedia Foundation
Status: Mediawiki Mediasearch Extension
Vendor: CVE Published:; 30 September 2026

🔔 Create The Wikimedia Foundation Vulnerability Alert

What is CVE-2026-103585?

A Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki MediaSearch extension, allowing attackers to inject malicious scripts through improperly neutralized HTML tags in web pages. This affects versions 1.46, 1.45, and 1.43, posing a risk to users by enabling the execution of harmful scripts within their browsers.

Affected Version(s)

MediaWiki MediaSearch extension 1.46

MediaWiki MediaSearch extension 1.45

MediaWiki MediaSearch extension 1.43

References

https://phabricator.wikimedia.org/T435999

https://gerrit.wikimedia.org/r/q/I79e8200289bd120c3c971ba...

CVSS V4

Score:

1.2

Severity:

LOW

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 30, 2026
Vulnerability Reserved
Sep 30, 2026

Credit

Marco Paciaroni (BomboBombone)

CVE-2026-103585 Data

JSON