This vulnerability allows stored cross‑site scripting in autocomment system messages within the Wikibase extension. An attacker can inject malicious JavaScript that will run in the browsers of any user who views an autocomment, potentially enabling phishing, cookie theft, or defacement. The weakness is described as an improper neutralization of input during web page generation and is identified by CWE‑79.

The Wikimedia Foundation’s Mediawiki Wikibase Extension is affected. Versions 1.39, 1.43, 1.44, and 1.45 contain the flaw. Users running any of these releases are at risk if autocomment messages are displayed to community members.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1 % shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the attacker to deliver a payload that will be stored and later displayed as an autocomment. No public exploits have been reported, but the low scoring reflects limited impact if a directly affected user is compromised. Given the low probability, immediate remediation is still recommended to prevent potential phishing or defacement attacks.