CVE-2026-22711
Received Received - Intake
Cross-Site Scripting in Mediawiki Wikilove Extension

Publication date: 2026-04-07

Last updated on: 2026-04-08

Assigner: wikimedia-foundation

Description
Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-07
Last Modified
2026-04-08
Generated
2026-06-16
AI Q&A
2026-04-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-22711
EUVD
EUVD-2026-19851
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
the_wikimedia_foundation mediawiki_wikilove_extension 1.43.7
the_wikimedia_foundation mediawiki_wikilove_extension 1.44.4
the_wikimedia_foundation mediawiki_wikilove_extension 1.45.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-87 The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an improper neutralization of alternate Cross-Site Scripting (XSS) syntax in the Wikimedia Foundation's Mediawiki Wikilove Extension. It allows attackers to inject malicious scripts into web pages viewed by other users.

Impact Analysis

The vulnerability can lead to Cross-Site Scripting (XSS) attacks, which may allow attackers to execute malicious scripts in the context of a user's browser. This can result in unauthorized actions, data theft, session hijacking, or other malicious activities affecting users of the Mediawiki Wikilove Extension.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart