CVE Intelligence

The Wikimedia Foundation vulnerabilities

🔔 Create alert RSS

Published CVEs affecting The Wikimedia Foundation products: 181 record(s), with severity, exploitation and fixes.

MediaWiki 45Mediawiki - Cargo Extension 15CheckUser 9Mediawiki - WikiLambda Extension 7Mediawiki - CentralAuth Extension 5Mediawiki - Wikibase Extension 4Mediawiki - GrowthExperiments Extension 4MediaWiki - UploadWizard extension 3AbuseFilter 3Vector 2Timeline 2VisualEditor 2Mediawiki - CirrusSearch Extension 2MediaWiki PageForms extension 2Scribunto 2Mediawiki - PageTriage Extension 2OATHAuth 2Mediawiki - TemplateSandbox Extension 2Mediawiki - CampaignEvents Extension 2MediaWiki - ProofreadPage Extension 2Mediawiki - Wikilove Extension 2Mediawiki - Translate Extension 2Mediawiki - Charts Extension 1Mediawiki - UrlShortener Extension 1Mediawiki - Thanks Extension 1Mediawiki - UserPageViewTracker Extension 1Wikipedia Android App 1SyntaxHighlight GeSHi 1CentralAuth 1OAuth 1UrlShortener 1Mediawiki - RedirectManager Extension 1MediaWiki CookieConsent extension 1Mediawiki - Wikistories 1Mediawiki - Skin:BlueSky 1Mediawiki - Collection extension 1MediaWiki MediaSearch extension 1MediaWiki CommonsMetadata extension 1MediaWiki Wikbase extension 1MediaWiki Wikistories extension 1

Exploited only (KEV) →

CVE-2026-103585 Low · 1.2 CWE-80 Sep 30, 2026
attacker-controlled javascript license URL via XSS
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.
CVE-2026-103584 Low · 1.1 CWE-80 Sep 30, 2026
attacker-controlled javascript license URL via XSS
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.
CVE-2026-103446 High · 7.4 CWE-639 Sep 30, 2026
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.
CVE-2026-103445 Low · 1.2 CWE-80 Sep 30, 2026
Stored XSS through PageForms #autoedit redirect links
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.
CVE-2026-103440 Low · 1.2 CWE-202 Sep 30, 2026
pagetriagelist discloses suppressed reviewer usernames
Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.
CVE-2026-103439 Low · 0.3 CWE-80 Sep 30, 2026
Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.
CVE-2026-103438 Low · 0.3 CWE-80 Sep 30, 2026
Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
CVE-2026-103437 Low · 1.1 CWE-80 Sep 30, 2026
ReadingLists imported metadata permits JavaScript URL XSS
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.
CVE-2026-103444 Low · 1.1 CWE-80 Sep 30, 2026
Stored XSS through system messages in WikiForum
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master.
CVE-2026-103443 Low · 1.1 CWE-80 Sep 30, 2026
API permits session-seeded javascript URL XSS
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection (Book) extension: 1.46, 1.45, and 1.43.
CVE-2026-103442 High · 7.2 CWE-15 Sep 30, 2026
MergeAccount PHP object injection via session-key substitution
External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.
CVE-2026-103441 High · 7.2 CWE-502 Sep 30, 2026
Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
CVE-2026-103051 Medium · 6.1 CWE-79 Sep 29, 2026
Stored i18n XSSs in CentralNotice
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103050 Medium · 6.1 CWE-79 Sep 29, 2026
Stored i18n XSS in MassMessage
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103049 Medium · 6.1 CWE-79 Sep 29, 2026
XSS in Cargo's Special:CargoQuery page due to unsanitized table headers
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1.
CVE-2026-103048 Medium · 6.1 CWE-601 Sep 29, 2026
Open Redirect in Special:Book
URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103047 Medium · 6.1 CWE-79 Sep 29, 2026
XSS through i18n message in CentralAuth
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103046 Medium · 6.1 CWE-79 Sep 29, 2026
WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.
CVE-2026-103045 Medium · 6.1 CWE-79 Sep 29, 2026
XSS in Refreshed skin
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103044 Critical · 9.8 CWE-91 Sep 29, 2026
EasyTimeline should not serve image maps as application/xml
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-102796 High · 7.5 CWE-89 Sep 29, 2026
Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100245 Medium · 6.1 CWE-79 Sep 29, 2026
Stored XSS on Wikibase Special:SetSiteLink via unescaped system message
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100244 High · 7.5 CWE-200 Sep 29, 2026
CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100243 Medium · 6.1 CWE-79 Sep 29, 2026
Stored XSS in WikiSEO author and image properties on action=info
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100242 High · 7.5 CWE-400 Sep 29, 2026
DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)
Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.