CVE-2026-100381
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The UploadWizard extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects versions from * before 1.46.1, 1.45.5, 1.43.10.
Risk Assessment
The risk includes the possibility of executing malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or other attacks.
Recommendation
It is recommended to update the UploadWizard extension to version 1.46.1, 1.45.5, or 1.43.10, which include the fix.
Other vulnerabilities in MediaWiki UploadWizard Extension
See all- CVE-2026-0671Medium
The UploadWizard extension for MediaWiki (versions 1.45, 1.44, 1.43, 1.39) contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker could inject malicious script code that executes in the user's browser.
- CVE-2025-62663Medium
The UploadWizard extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS