CVE-2026-100243: Stored XSS in WikiSEO author and image properties on action=info
Published Sep 29, 2026
·Updated
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS.
This issue affects Mediawiki - WikiSEO Extension: from before 1.46.1, 1.45.5, 1.43.10.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki WikiSEO Extension<1.46.1, <1.45.5, <1.43.10
Event History
Sep 29, 2026
CVE Published
via MITRE·04:43 PM
Data Sourced
via MITRE·04:43 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which versions should be updated?
Update the WikiSEO Extension to 1.46.1, 1.45.5, or 1.43.10, as appropriate for the deployed MediaWiki release branch. Versions before these fixes are affected.
2
What is required for exploitation?
An attacker would need to cause malicious script content to be stored in WikiSEO author or image properties. The stored content can execute when the relevant information is displayed through action=info.