The Mediawiki Flow Extension contains an improper neutralization of input during web page generation that permits malicious scripts to be stored and executed within page content. This stored XSS can lead to session hijacking, credential disclosure, or defacement. The weakness is classified as CWE‑79, where user‑supplied text is rendered without sufficient sanitization. The potential for exploitation depends on the attacker’s ability to inject content into Flow messages and the trust model of the affected installation.

Any Mediawiki site that uses the Flow Extension with a version earlier than 1.46.1, 1.45.5, or 1.43.10 is affected. Admins deploying Flow Messages, colon separators, or the flow-guidedtour-optin-welcome-description feature in these releases cannot assume content is safe.

The vulnerability could be exploited by an attacker who can inject content into Flow messages, which is inferred because the description indicates stored XSS but does not explicitly state the attacker’s prerequisites. Potential victims include all users who view the affected content. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog; nevertheless, the stored XSS nature presents a serious risk. Administrators should treat this as a high‑priority issue until the extension is updated or the vulnerable features are disabled. The CVSS score is 6.1, reflecting moderate severity.