Improper neutralization of input during web page generation in the WikiLambda Extension allows stored cross‑site scripting attacks. An attacker can embed malicious JavaScript payloads through the VisualEditor interface, which are then persisted in page content and executed when any authenticated or unauthenticated user views the page. This flaw can lead to the theft of session data, defacement, or the execution of arbitrary code in the context of the wiki, violating confidentiality and integrity.

The issue affects the Wikimedia Foundation MediaWiki WikiLambda Extension, specifically version 1.47.0-alpha. The fixed code resides in the master branch, and updates are available in subsequent stable releases. No other vendor or product combinations are listed as affected.

The CVSS score of 4.8 indicates a moderate risk, and the vulnerability has not been reported in CISA’s KEV catalog, with no publicly available EPSS data. The attack vector is inferred to be a web-based user interface; a user with sufficient editing privileges can input malicious content that is persisted and later delivered to all viewers. Because the flaw is stored, an attacker need only a single injection to compromise the entire site if no additional mitigating controls exist.