This vulnerability arises when the ProofreadPage Extension does not fully neutralize CSS input, allowing attackers to inject malicious code into page rendering. The weakness corresponds to CWE‑79, enabling cross‑site scripting that can execute arbitrary scripts in the context of a victim user, potentially leading to session hijacking, data theft, or defacement.

The issue affects Wikimedia Foundation MediaWiki installations that use the ProofreadPage Extension. Versions before MediaWiki 1.43 are vulnerable; patches are available on the master branch and in the release branches for MediaWiki 1.43, 1.44 and 1.45.

With a CVSS score of 6.9 the risk is moderate to high, but the EPSS indicates a very low likelihood of exploitation (<1%). The vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit it by inserting malicious CSS into content processed by the extension, which will be rendered in the browsers of all users who view the affected page.