The vulnerability is a stored cross‑site scripting flaw in the Wikimedia Foundation MediaWiki WikiSEO Extension that occurs when untrusted input supplied through the author and image properties is not properly encoded during page rendering in action=info. Based on the description, it is inferred that an attacker could inject JavaScript that persists in the page and executes within the browsers of users who view the affected info page, potentially allowing the attacker to compromise user sessions or alter page content.

The flaw impacts MediaWiki sites that use the WikiSEO Extension version 1.46.0 or earlier, including releases 1.45.5, 1.43.10, and any build prior to 1.46.1. Sites running those versions without an update are vulnerable.

The CVSS score of 6.1 denotes moderate severity, while the EPSS score of < 1 % indicates a low current exploitation probability. The stored nature of the injection means that any user who can modify the author or image fields may deliver the payload. Based on the description, it is inferred that the attacker would need permissions to edit those fields; no additional external conditions are required. The vulnerability is not listed in the CISA KEV catalog.