The vulnerability allows an attacker to insert malicious JavaScript into stored i18n/message‑key data used by the UploadWizard extension. When a user views a page that renders these keys, the injected script executes in the user’s browser. This can lead to session hijacking, defacement, or the delivery of malware in the context of authenticated users. The weakness is a classic stored XSS flaw documented as CWE‑79.

The MediaWiki UploadWizard extension is affected, specifically versions 1.39, 1.43, 1.44, and 1.45 from the Wikimedia Foundation. An instance running any of these versions that accepts user‑supplied i18n/message‑key data is vulnerable.

The CVSS score of 6.1 indicates a moderate impact, while the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely the web interface of the UploadWizard component, where an attacker can create or edit i18n/message‑key data that is subsequently rendered for other users.