CVE-2026-0671
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The UploadWizard extension for MediaWiki (versions 1.45, 1.44, 1.43, 1.39) contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker could inject malicious script code that executes in the user's browser.
Risk Assessment
This could lead to session theft, account takeover, or modification of content visible to users. MediaWiki users with the extension installed are at risk.
Recommendation
Update the UploadWizard extension to a version containing the fix. If updating is not possible, consider disabling the extension until a patch is released.
Other vulnerabilities in MediaWiki - UploadWizard extension
See all- CVE-2026-100381Medium
The UploadWizard extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects versions from * before 1.46.1, 1.45.5, 1.43.10.
- CVE-2025-62663Medium
The UploadWizard extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - UploadWizard extension: 1.45, 1.44, 1.43, 1.39.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS