Description
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS).

This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.
Published: 2026-09-30
Score: 1.2 Low
EPSS: n/a
KEV: No
Impact: Cross‑Site Scripting
Action: Patch Extension
AI Analysis

Impact

Improper neutralization of script tags in the MediaWiki MediaSearch extension allows attacker‑controlled JavaScript to be injected via the license URL field. This basic XSS flaw can lead to client‑side script execution, potentially hijacking user sessions or enabling further attacks on the site.

Affected Systems

MediaWiki MediaSearch extension versions 1.46, 1.45, and 1.43 are affected. The flaw resides in the license URL handling of these extensions.

Risk and Exploitability

The CVSS score is 1.2, indicating low severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious license URL that an end user will load, making it a client‑side XSS exploit dependent on users viewing a compromised page. While low-scoring, compromised users could still be impacted.

Generated by OpenCVE AI on September 30, 2026 at 23:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an update to the MediaWiki MediaSearch extension that includes the XSS fix or upgrade to any patched later version.
  • If an update cannot be applied immediately, disable or sanitize the license URL field in the extension configuration to block script injection.
  • Implement a Content Security Policy that disallows inline scripts or restricts script sources to trusted domains.
  • Monitor the extension configuration logs for unexpected JavaScript injections.

Generated by OpenCVE AI on September 30, 2026 at 23:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Description Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.
Title attacker-controlled javascript license URL via XSS
Weaknesses CWE-80
References
Metrics cvssV4_0

{'score': 1.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-09-30T22:17:37.554Z

Reserved: 2026-09-30T22:09:48.919Z

Link: CVE-2026-103585

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-30T23:16:57.890

Modified: 2026-09-30T23:16:57.890

Link: CVE-2026-103585

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T23:30:07Z

Weaknesses
  • CWE-80

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)