CVE-2026-0671: Multiple stored i18n/message-key XSSes in UploadWizard
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - UploadWizard extension: 1.45, 1.44, 1.43, 1.39.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0671?
CVE-2026-0671 has been classified as a significant security vulnerability due to its potential for Cross-Site Scripting (XSS).
How do I fix CVE-2026-0671?
To mitigate CVE-2026-0671, update the MediaWiki - UploadWizard extension to version 1.46 or later, which contains the necessary patches.
Which versions are affected by CVE-2026-0671?
CVE-2026-0671 affects MediaWiki - UploadWizard extension versions 1.39 through 1.45 inclusively.
What type of vulnerability is CVE-2026-0671?
CVE-2026-0671 is classified as an Improper Neutralization of Input During Web Page Generation vulnerability, specifically related to Cross-Site Scripting (XSS).
Who is impacted by CVE-2026-0671?
Users of the MediaWiki - UploadWizard extension in the affected versions are at risk of exploitation through Cross-Site Scripting attacks.