The vulnerability arises from improper neutralization of user‑supplied content in the Monaco skin of MediaWiki, allowing malicious actors to inject and execute arbitrary script code on page loads. This flaw can lead to theft of session cookies, defacement of content, or redirection to phishing sites. The weakness is categorized as CWE‑79 and is considered a classic XSS bug. No denial of service or configuration SQL injection is reported in the official description.

Vendors and products impacted include The Wikimedia Foundation’s MediaWiki platform when using the Monaco skin. The skin versions explicitly listed—1.45, 1.44, 1.43, and 1.39—are vulnerable. Users running any of those versions should review their deployment of the Monaco skin.

The CVSS score of 2.3 indicates a low severity assessment, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog, further underscoring its limited threat. Attackers would need to attract browsers to a page rendered with the vulnerable skin, which typically involves social engineering or compromised content. Because the flaw resides in the rendering layer and not in authentication or authorization, reach is limited to visitors to affected pages.