CVE-2026-0670

MediumCVSS 6.1

Published: 07/01/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39.

Risk Assessment

An attacker could execute arbitrary JavaScript in the victim's browser context, potentially leading to session data theft or unauthorized actions.

Recommendation

Update the ProofreadPage extension to a patched version or implement additional input sanitization mechanisms.

Other vulnerabilities in MediaWiki - ProofreadPage Extension

CVE-2026-39838Medium
The ProofreadPage extension for MediaWiki is vulnerable to Cross-Site Scripting (XSS) targeting non-script elements. The issue is fixed in the master branch and in MediaWiki versions 1.43, 1.44, and 1.45.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS