The vulnerability arises from improper neutralization of user input during web page generation in the GlobalWatchlist Extension. This flaw enables a malicious actor to inject and execute arbitrary JavaScript, which could lead to data theft, phishing, or manipulation of the user experience. The weakness is identified as a reflected XSS, providing attackers with the means to compromise confidentiality and integrity of affected users.

The impact is limited to installations of MediaWiki that use the GlobalWatchlist Extension, specifically those running MediaWiki versions 1.43, 1.44, or 1.45. Systems that have upgraded to these release branches or the master branch are not affected. Older or unpatched installations remain vulnerable.

The CVSS base score of 6.9 indicates a moderate to high risk, yet the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, which again points to a lower likelihood of widespread attacks. Attackers could exploit the flaw by delivering a crafted watchlist entry or link containing malicious script to a victim, who would then execute it in their browser. Fixing the input sanitization in the removes the attack surface.