CVE-2026-103444
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in MediaWiki WikiForum Extension

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: wikimedia-foundation

Description
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103444
EUVD
EUVD-2026-90082

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_wikimedia_foundation mediawiki_wikiforum_extension to master (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the MediaWiki WikiForum extension. It occurs because the extension improperly neutralizes script-related HTML tags in web pages, allowing malicious scripts to be stored and later executed when users view affected pages.

Impact Analysis

An attacker could inject malicious scripts into the WikiForum extension. When other users view the compromised content, the scripts may execute in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing unauthorized actions on their behalf.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using the affected extension may face compliance violations and potential legal consequences.

Mitigation Strategies

Update the MediaWiki WikiForum extension to the latest patched version to resolve the stored XSS vulnerability. The patch was merged in Gerrit and addresses the insecure i18n system messages causing the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103444. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart