The vulnerability arises from unsafe string replacements performed by WikifunctionsFragmentRenderer during rendering of user‑provided HTML. This improper neutralization of input allows stored cross‑site scripting. An attacker can embed malicious JavaScript that will run in the browsers of any user who views the vulnerable WikiLambda function, potentially allowing credential theft, session impersonation, or other client‑side attacks. The flaw is classified as CWE‑79.

MediaWiki WikiLambda extension versions older than 1.46.1 are affected. This includes all installations that have not applied the 2026 security release. Users of the extension should confirm the current version and plan for an update.

With a CVSS score of 6.1 the flaw is deemed moderate severity. The EPSS score of <1% indicates a low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers need the ability to submit or edit WikiLambda functions containing arbitrary HTML; based on the description the likely attack vector involves the insertion of malicious markup during function creation or modification. Because the impact is stored, any user who views the affected function could be exposed.