This vulnerability arises from an improper neutralization of input in the Wikibase extension, allowing attackers to embed malicious JavaScript into a system message that is not escaped when rendered. The stored payload executes in the browsers of any user who views the message, enabling session hijacking, defacement, or malware delivery. The weakness is identified as CWE-79.

Affected are releases of the Wikimedia Foundation MediaWiki Wikibase Extension recorded as before 1.46.1, 1.45.5, and 1.43.10. Any site running those versions is susceptible, regardless of the Wikimedia project.

CVSS score of 6.1 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation to date. Attackers can leverage available editing rights or credentials to inject the malicious system message, after which any visitor will execute the script automatically.