This vulnerability is a stored cross‑site scripting flaw in MediaWiki’s Special:Block component. Improper neutralization of input in a system message allows injected code to be rendered during the block page view. The CVE description does not list explicit consequences; typical XSS effects such as cookie theft or defacement may be possible, but those outcomes are inferred from common XSS behavior rather than confirmed for this specific flaw.

The affected vendor is Wikimedia Foundation MediaWiki. No concrete version range is documented; any deployment that still contains the vulnerable Special:Block codex implementation located in resources/src/mediawiki.Special.Block/SpecialBlock.Vue is at risk.

The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The most likely attack path requires an attacker who can add or edit the system message used by Special:Block, or who can otherwise influence the content stored in those messages. Once injected, the stored XSS would affect any user who subsequently visits the compromised block page.