The vulnerability is a stored cross‑site scripting flaw in the CentralAuth extension of Mediawiki. Improper neutralization of input in internationalization messages permits a malicious script to be saved and rendered on every page that includes the message. Attackers can run arbitrary JavaScript in the browsers of users who view affected content, potentially exposing data or capturing credentials.

The Wikimedia Foundation's Mediawiki CentralAuth extension prior to versions 1.46.1, 1.45.5, and 1.43.10. All installations of Mediawiki that load this extension are vulnerable, independent of the core Mediawiki version.

The flaw is typical stored XSS (CWE‑79). The CVSS score is 6.1, indicating moderate severity. The EPSS score is <1%, indicating very low but nonzero exploitation probability. There is no listing in the CISA KEV catalog, suggesting that exploitation has not yet been widely observed. Still, because the attacker can execute client‑side code on every user who views the malicious i18n entry, the potential impact is high. Exploitation requires the ability to modify the extension’s i18n message configuration; no network‑level access is needed.