The Charts Extension for MediaWiki contains a stored cross‑site scripting vulnerability through the Data:*.tab title field; the input is not properly neutralized during page generation. When a chart containing such a title is viewed, the browser interprets the payload as script and executes it in the context of the site, providing arbitrary JavaScript execution on each visitor’s browser. The likely attack vector is an attacker with permission to create or edit charts who injects malicious payloads into the Data:*.tab title field, which are then stored and subsequently executed whenever any user opens the chart. This flaw represents a classic Cross‑Site Scripting (CWE‑79) vulnerability.

The vulnerability affects installations of the Wikimedia Foundation MediaWiki Charts Extension versions earlier than 1.43.9, 1.44.6, 1.45.4. All sites that host or use these legacy extensions are at risk.

The CVSS score of 6.9 reflects moderate severity, and the EPSS score of less than 1 % indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no known exploits are currently documented. Exploitation requires the attacker to create or edit a chart that includes a malicious payload in the Data:*.tab title field; the payload is stored and subsequently executed whenever a user opens the chart. The likely attack vector involves legitimate chart creation or editing access, and because it is a stored XSS, any user who views the affected chart will have the script run in the context of the site.