CVE-2026-100237: Stored i18n XSS in the Flow integration of Thanks
Published Sep 25, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS.
This issue affects Mediawiki - Thanks Extension: from before 1.43.10/1.45.5/1.46.1.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki Thanks Extension<1.43.10, <1.45.5, <1.46.1
Event History
Sep 25, 2026
CVE Published
via MITRE·04:47 PM
Data Sourced
via MITRE·04:47 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
MediaWiki installations using the Thanks extension are affected if they run a version before 1.43.10, 1.45.5, or 1.46.1.
2
What type of attacker interaction is involved?
The issue is a stored cross-site scripting vulnerability in the Flow integration of the Thanks extension. It involves insufficient neutralization of input when generating web pages.