CVE-2026-58038
Received Received - Intake

Cross-Site Scripting in Wikimedia Timeline

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: wikimedia-foundation

Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-58038
EUVD
EUVD-2026-41022

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
wikimedia_foundation timeline to 1.46.0 (exc)
wikimedia_foundation timeline 1.45.4
wikimedia_foundation timeline 1.44.6
wikimedia_foundation timeline 1.43.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). It affects the Wikimedia Foundation timeline component, specifically in the files includes/Timeline.Php and scripts/EasyTimeline.Pl. The issue arises when input is not properly sanitized before being included in web pages, potentially allowing attackers to inject malicious scripts.

Impact Analysis

An XSS vulnerability can allow attackers to execute malicious scripts in the context of a user's browser. This can lead to unauthorized actions such as stealing session cookies, redirecting users to malicious sites, or performing actions on behalf of the user without their consent.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart