The Wikimedia Foundation Mediawiki - Wikibase Extension vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting The Wikimedia Foundation Mediawiki - Wikibase Extension: 4 record(s), with affected versions and fixes.
CVE-2026-103441
High · 7.2
Public exploit CWE-502 Sep 30, 2026
Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.
This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
CVE-2026-100245
Medium · 6.1
CWE-79 Sep 29, 2026
Stored XSS on Wikibase Special:SetSiteLink via unescaped system message
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS.
This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100380
Medium · 5.3
CWE-79 Sep 25, 2026
Reflected XSS in Wikibase Special:SetLabel language validation
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).
This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-22710
Medium · 5.4
CWE-79 Jan 8, 2026
Stored XSS through autocomment system messages in Wikibase
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.