Improper encoding through magic word replacement in the ParserAfterTidy step of the ApprovedRevs extension allows an attacker to inject malicious or unintended CSS into the page output. This bypasses the inline CSS sanitizer, potentially enabling style-based defacement, click‑jacking, or obscure XSS vectors. The weakness is classified under CWE‑116 for improper output encoding and has a CVSS score of 2.3, indicating low severity but the impact could still harm user experience or enable subtle content manipulation.

The vulnerability affects the ApprovedRevs extension of MediaWiki produced by The Wikimedia Foundation. Versions 1.39, 1.43, 1.44, and 1.45 are vulnerable.

Because the CVSS is 2.3 and EPSS is less than 1%, the risk of exploitation is considered very low. The likely attack vector is content manipulation via magic words that the extension processes, which is inferred from the description. Since the issue involves output encoding, an attacker would need to inject crafted CSS through approved content or magic word processing to affect the rendering for users who view these pages. The vulnerability is not listed in CISA’s KEV catalog, further supporting its low exploitation likelihood.