Improper neutralization of user supplied data in the UploadWizard Flickr import and title fields triggers DOM‑based Cross‑Site Scripting, allowing an attacker to inject and execute arbitrary client‑side JavaScript. This can enable credential theft, session hijacking, or defacement when a victim visits an affected page.

Vulnerable to the Mediawiki UploadWizard Extension, including all editions released before 1.46.1, 1.45.5, and 1.43.10 from the Wikimedia Foundation.

The CVSS score of 5.3 indicates medium severity. The exploit is a client‑side attack that requires a user to interact with an UploadWizard page or to view the faulty title entry; automated exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog and there is no EPSS score available, so current exploitation likelihood is unknown but performing the attack would need user interaction or malicious webpage embedding.