The vulnerability is a stored cross‑site scripting flaw that occurs when a system message incorporates a user‑provided parameter without proper escaping. An attacker can inject malicious scripts that will be executed in the context of any user who views the affected page, potentially allowing data theft, session hijacking, or defacement of the site. The weakness is identified as CWE‑79, representing an improper neutralization of input during web page generation.

MediaWiki ProofreadPage Extension versions 1.39, 1.43, 1.44, and 1.45 from the Wikimedia Foundation are affected. Any installation of these extensions that allows the creation or modification of system messages is potentially vulnerable.

The CVSS score of 6.1 indicates moderate severity. EPSS is reported as less than 1 %, reflecting a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector is an attacker who has the ability to create or edit system messages. Once injected, the malicious payload will be stored and served to all users, making it a potentially widespread threat within the affected installation.