The vulnerability is a stored cross‑site scripting flaw in the MassMessage extension of Mediawiki. Improper sanitization of user input during page generation enables an attacker to embed malicious script that persists in the message. When a victim loads the message page, the injected code executes in the victim’s browser, potentially allowing session hijacking, data theft, or malicious redirects. This weakness is classified as CWE‑79.

The flaw affects the Mediawiki MassMessage extension on versions preceding 1.46.1, 1.45.5, and 1.43.10. Systems using these older versions, typically maintained by the Wikimedia Foundation, are vulnerable. Administrators should verify the installed extension version and plan an update.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 6.1, indicating moderate severity, but the lack of an availability score does not reduce the potential impact. Because the flaw is stored XSS, any user with the ability to submit mass messages can insert arbitrary script; the attack surface is inherent to any site that allows MassMessage usage. The likely attack vector involves a controlled submission through the MassMessage form, after which the malicious script is served to recipients accessing the same message.