The vulnerability is a reflected cross‑site scripting flaw in the CirrusSearch extension of MediaWiki. When the debug explain output is requested, malicious input is not properly escaped, allowing an attacker to inject script that runs in the victim’s browser. Based on the description, it is inferred that this could lead to session hijacking, credential theft, or arbitrary code execution within the context of the user’s session.

The issue impacts the CirrusSearch extension bundled with MediaWiki, affecting all versions up to and including 1.46.0. The extension is maintained by the Wikimedia Foundation.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely a crafted web request that triggers the debug explain endpoint. An attacker can exploit the flaw remotely by sending a URL containing malicious payload to a victim’s browser that has access to the debug explain page.