Cross-Site Scripting in Mediawiki Wikilove Extension

Publication date: 2026-04-07

Last updated on: 2026-04-08

Assigner: wikimedia-foundation

Description

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-07

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2026-04-07

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22711

EUVD

EUVD-2026-19851

Affected Vendors & Products

Vendor	Product	Version / Range
the_wikimedia_foundation	mediawiki_wikilove_extension	1.43.7
the_wikimedia_foundation	mediawiki_wikilove_extension	1.44.4
the_wikimedia_foundation	mediawiki_wikilove_extension	1.45.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-87	The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper neutralization of alternate Cross-Site Scripting (XSS) syntax in the Wikimedia Foundation's Mediawiki Wikilove Extension. It allows attackers to inject malicious scripts into web pages viewed by other users.

Impact Analysis

The vulnerability can lead to Cross-Site Scripting (XSS) attacks, which may allow attackers to execute malicious scripts in the context of a user's browser. This can result in unauthorized actions, data theft, session hijacking, or other malicious activities affecting users of the Mediawiki Wikilove Extension.

Hi! I’m here to help you understand CVE-2026-22711. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70