The vulnerability is a stored cross‑site scripting flaw caused by insufficient neutralization of input when generating web pages in the Mediawiki – Thanks Extension. Attackers could embed malicious script into user‑visible content, potentially hijacking user sessions, defacing pages, or executing further actions in the victim’s browser. The description does not detail the specific input vectors, but it can be inferred that user‑supplied i18n messages or extension inputs are stored and later rendered without proper escaping.

The Wikimedia Foundation’s Mediawiki – Thanks Extension before 1.43.10, 1.45.5, or 1.46.1 is affected. Systems running those or earlier revisions are vulnerable.

The CVSS score of 6.1 indicates a moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web form or content input that feeds unsanitized data into the rendered page. Exploitation would require that the attacker can create or modify an entry that is subsequently displayed to other users.