Cross-site Scripting Vulnerability in MediaWiki by Wikimedia Foundation
CVE-2026-58032

5.3MEDIUM

Key Information:

Vendor: Wikimedia Foundation
Status: Mediawiki
Vendor: CVE Published:; 1 July 2026

🔔 Create Wikimedia Foundation Vulnerability Alert

What is CVE-2026-58032?

A Cross-site Scripting (XSS) vulnerability exists in MediaWiki, arising from improper neutralization of input during web page generation. This issue could allow attackers to inject malicious scripts into web pages viewed by users, leading to unauthorized actions or data theft. The vulnerability is linked to specific program files, highlighting the need for prompt updates and robust security practices to mitigate risks. Affected users should upgrade to versions 1.46.0 or later to safeguard against potential attacks.

Affected Version(s)

MediaWiki * < 1.46.0, 1.45.4, 1.44.6, 1.43.9

References

https://phabricator.wikimedia.org/T426867

CVSS V4

Score:

5.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 1, 2026
Vulnerability Reserved
Jun 27, 2026

CVE-2026-58032 Data

JSON