Improper neutralisation of input during page generation in the CentralNotice extension results in stored cross‑site scripting, allowing an attacker to inject and maintain malicious scripts that execute whenever a user views a notice. Such scripts can deface pages, steal credentials, or redirect users to phishing sites. The weakness is identified as CWE‑79.

The MediaWiki CentralNotice extension is vulnerable in releases before 1.46.1, 1.45.5, and 1.43.10. These versions are used on Wikimedia Foundation sites and possibly on other MediaWiki installations that have not applied the fix.

The vulnerability enables attackers to inject malicious content via the notice creation/edit interface, which is then served to all viewers. While no public exploit is listed, the EPSS score is < 1% and the CVSS score of 6.1 indicates moderate severity. The potential for widespread impact is high if the extension is publicly accessible, and the lack of a KEV listing does not diminish the risk posed by the cross‑site scripting flaw, especially on sites that allow community contributions to notices.