CVE-2026-100238: Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS
Published Sep 29, 2026
·Updated
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS.
This issue affects Mediawiki - Flow Extension: from before 1.46.1, 1.45.5, 1.43.10.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki - Flow Extension<1.46.1, <1.45.5, <1.43.10
Event History
Sep 29, 2026
CVE Published
via MITRE·04:12 PM
Data Sourced
via MITRE·04:12 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which Flow Extension release should we upgrade to?
Upgrade to 1.46.1, 1.45.5, or 1.43.10, depending on the MediaWiki release branch you run. Earlier versions in those branches are affected.