CVE-2026-103585

Received Received - Intake

Basic XSS in MediaWiki MediaSearch Extension

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: wikimedia-foundation

Description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-103585

EUVD

EUVD-2026-90431

Affected Vendors & Products

Vendor	Product	Version / Range
the_wikimedia_foundation	mediawiki_mediasearch_extension	1.46
the_wikimedia_foundation	mediawiki_mediasearch_extension	1.45
the_wikimedia_foundation	mediawiki_mediasearch_extension	1.43

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

This is a basic Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation MediaWiki MediaSearch extension. It occurs due to improper neutralization of Script-Related HTML tags in a web page, allowing attackers to inject malicious scripts.

Detection Guidance

This vulnerability involves improper neutralization of Script-Related HTML tags in the MediaWiki MediaSearch extension. Detection requires checking for XSS payloads in user inputs or rendered pages. Inspect MediaWiki logs for unusual script tags or HTML injection attempts. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in a victim's browser when they view a page with the vulnerable extension. This could lead to session hijacking, data theft, or defacement of the wiki page.

Compliance Impact

This XSS vulnerability could expose user data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by allowing unauthorized access or modification of sensitive information.

Mitigation Strategies

Update the MediaWiki MediaSearch extension to a version that is not affected by this vulnerability. The issue affects versions 1.46, 1.45, and 1.43, so upgrade to a patched release.

Hi! I’m here to help you understand CVE-2026-103585. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70