The Bucket extension for MediaWiki, prior to version 2.1.1, contains a stored cross‑site scripting flaw. A malicious actor can insert arbitrary JavaScript into any table field labeled as PAGE, and the script will run whenever a user views the corresponding namespace page. The weakness is a classic stored XSS, classified as CWE‑79, and may allow victim browsers to execute code supplied by the attacker.

All builds of the MediaWiki extension named Bucket distributed by the vendor weirdgloop are affected if the version is older than 2.1.1. Versions 2.1.1 and later incorporate the fix and are considered safe.

The CVSS base score of 8.8 indicates high severity, while the EPSS score of less than 1 percent suggests a low likelihood of exploitation at present. The vulnerability is not included in the CISA KEV catalog. Exploitation requires an attacker to write data to a PAGE‑type field. The description does not specify required privileges; it is inferred that such writes may require editor or higher access. After the payload is stored, any user who visits the affected namespace page will have the script executed.