The identified flaw is a cross‑site scripting vulnerability arising from improper neutralization of user‑controlled input in MediaWiki’s log‑formatting routines. Based on the description, it is inferred that an attacker can influence the content that is written to a log—such as by creating or editing a page that triggers a log entry, or by causing an exception that records arbitrary data—allowing malicious JavaScript to be embedded in the resulting log page. This weakness is formally designated CWE‑79 and can lead to session hijacking, defacement, or other client‑side damage for users who view the affected log pages.

MediaWiki installations from the earliest releases up to but not including version 1.46.0 are vulnerable, with documented affected releases being 1.45.4, 1.44.6, and 1.43.9. The vulnerability resides in core files such as includes/Language.php, includes/Logging/BlockLogFormatter.php, LogFormatter.php, PatrolLogFormatter.php, RenameuserLogFormatter.php, TagLogFormatter.php, and includes/Specials/SpecialVersion.php. The issue is intrinsic to the MediaWiki core and is not confined to any specific extension.

Based on the EPSS score of less than 1 %, it is inferred that the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, based on the description, it is inferred that the attack vector involves web pages displaying logs; an attacker who can insert unescaped data into a log entry can force users to load a malicious log page, resulting in arbitrary JavaScript execution. The impact upon the affected user is significant in terms of confidentiality and integrity of session data, but the overall risk to the system as a whole remains moderate given the current low exploitation probability.