Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.

This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
Published: 2026-09-29
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Patch Now
AI Analysis

Impact

This vulnerability is a stored cross‑site scripting flaw (CWE‑79) caused by improper neutralization of user input during page rendering for the Refreshed skin of MediaWiki. It allows malicious JavaScript to be persisted in the wiki, executing whenever a user views a page containing the injected content. The impact is the execution of that script in the context of the viewing user.

Affected Systems

The flaw affects MediaWiki users who employ the Refreshed skin from the Wikimedia Foundation. Versions prior to 1.46.1, 1.45.5, and 1.43.10 are vulnerable when using that skin. Upgrading to the latest skin release resolves the issue.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly confirmed exploitation at this time. The CVSS score of 6.1 reflects a moderate severity level. Based on the description, the attack vector is inferred to be through content rendered by the skin, such as page bodies or user‑supplied HTML/CSS. Successful exploitation would require that the attacker be able to inject malicious JavaScript into a page and that a user view that page.

Generated by OpenCVE AI on October 1, 2026 at 00:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Refreshed skin to the latest patched version, at least 1.46.1, 1.45.5, or 1.43.10, depending on your MediaWiki release.
  • If immediate upgrade is not possible, disable the Refreshed skin for all users until the update is applied.
  • Restrict edit permissions to trusted users only and consider disabling custom HTML or CSS insertion until the vulnerability is fixed.

Generated by OpenCVE AI on October 1, 2026 at 00:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared The Wikimedia Foundation
The Wikimedia Foundation mediawiki - Refreshed Skin
Vendors & Products The Wikimedia Foundation
The Wikimedia Foundation mediawiki - Refreshed Skin

Tue, 29 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Description Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
Title XSS in Refreshed skin
Weaknesses CWE-79
References

Subscriptions

The Wikimedia Foundation Mediawiki - Refreshed Skin
cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-09-30T20:24:48.261Z

Reserved: 2026-09-29T22:29:32.001Z

Link: CVE-2026-103045

cve-icon Vulnrichment

Updated: 2026-09-30T20:24:39.895Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T23:17:22.327

Modified: 2026-09-30T21:17:07.650

Link: CVE-2026-103045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T00:30:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')