CVE-2026-100237

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in MediaWiki Thanks Extension

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: wikimedia-foundation

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-100237

EUVD

EUVD-2026-87204

Affected Vendors & Products

Vendor	Product	Version / Range
the_wikimedia_foundation	mediawiki_thanks_extension	to 1.46.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Wikimedia Foundation MediaWiki Thanks Extension. It occurs due to improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts that are stored on the server and executed when other users view the page.

Detection Guidance

This vulnerability is specific to the MediaWiki Thanks Extension and requires manual inspection of the extension's code and configuration. There are no direct network or system commands to detect this stored XSS vulnerability. Review the extension version against the affected releases (before 1.43.10/1.45.5/1.46.1) and check for untrusted input handling in user-generated content.

Impact Analysis

An attacker could exploit this to steal user sessions, deface pages, or perform actions on behalf of users. Users viewing affected pages may have their data compromised or be redirected to malicious sites without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to protect user data adequately.

Mitigation Strategies

Update the Mediawiki - Thanks Extension to version 1.43.10, 1.45.5, or 1.46.1 or later to address the stored XSS vulnerability.

Hi! I’m here to help you understand CVE-2026-100237. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70