A stored cross‑site scripting vulnerability exists in the EasyTimeline module of the Wikimedia Foundation Timeline application. JavaScript URLs embedded within SVG files are not properly sanitized, allowing an attacker to inject malicious scripts that are stored and executed whenever a user renders a timeline containing the compromised SVG. This flaw corresponds to CWE‑79 and can compromise the confidentiality, integrity, and availability of any user session that views the affected content.

The Wikimedia Foundation Timeline software is vulnerable in all releases prior to version 1.46.0, as well as the snapshots 1.45.4, 1.44.6, and 1.43.9. These versions utilize the EasyTimeline component to process SVG files, which is the source of the sanitizer bypass.

The CVSS score of 6.1 indicates medium severity, and the EPSS score of less than 1% indicates that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be able to insert or modify a JavaScript URL within an SVG file that the EasyTimeline component will process; once stored, the malicious script will execute whenever any user opens the timeline featuring that SVG. The stored nature of the payload means that a single exploitation can affect multiple users over time.