CVE-2024-23176

Awaiting Analysis Awaiting Analysis - Queue

MassMessage Extension XSS Vulnerability in MediaWiki

Publication date: 2026-09-14

Last updated on: 2026-09-28

Assigner: MITRE

Description

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-28

Generated

2026-10-04

AI Q&A

2026-09-14

EPSS Evaluated

2026-10-03

NVD

CVE-2024-23176

EUVD

EUVD-2024-55763

Affected Vendors & Products

Vendor	Product	Version / Range
mediawiki	massmessage	to 1.40.2 (exc)
mediawiki	mediawiki	1.35.14
mediawiki	mediawiki	1.39.6
mediawiki	mediawiki	1.40.2
mediawiki	mediawiki	1.41.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2024-23176 is a cross-site scripting (XSS) vulnerability in the MediaWiki MassMessage extension. It occurs due to improper handling of the i18n key massmessage-form-page-help, which allows XSS attacks when the $wgUseXssLanguage setting is enabled. The vulnerability arises because HTMLFormField help attributes wrap content in HtmlArmor without proper escaping.

Detection Guidance

To detect this vulnerability, check if your MediaWiki instance uses the MassMessage extension and if the $wgUseXssLanguage setting is enabled. Inspect URLs with uselang=x-xss parameters for XSS payloads in the massmessage-form-page-help i18n key. Review Special:MassMessage pages for improperly escaped content.

Impact Analysis

This vulnerability could allow attackers to inject malicious scripts into web pages viewed by users. If exploited, it may lead to unauthorized actions on behalf of users, data theft, or session hijacking. Users with the MassMessage extension enabled are at risk if the vulnerable setting is active.

Compliance Impact

XSS vulnerabilities can compromise data integrity and confidentiality, potentially violating GDPR and HIPAA requirements for protecting personal and health data. Organizations using MediaWiki with MassMessage may face compliance risks if exploited.

Mitigation Strategies

Upgrade MediaWiki to version 1.39.6, 1.40.2, or 1.41.0 or later. Ensure the MassMessage extension is updated. Disable the $wgUseXssLanguage setting if enabled. Apply patches for REL1_39, REL1_40, REL1_41, master, and wmf branches if using older versions.

Hi! I’m here to help you understand CVE-2024-23176. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70