CVE-2026-103047
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
Update the CentralAuth extension to version 1.46.1, 1.45.5, or 1.43.10 (or later) depending on the branch in use.
Other vulnerabilities in MediaWiki CentralAuth extension
See all- CVE-2026-100244High
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows data excavation. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.
- CVE-2026-39937High
The CentralAuth extension of MediaWiki improperly removes sensitive information before storage or transfer, leading to resource leak exposure. The issue is fixed on the master branch and in versions 1.43, 1.44, and 1.45.
- CVE-2025-62669Medium
The CentralAuth extension for MediaWiki exposes sensitive information to unauthorized actors, leading to resource leak exposure. This affects versions from master before 1.39.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS