CVE-2026-103045: XSS in Refreshed skin
Published Sep 29, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.
This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki Refreshed skin<1.46.1, <1.45.5, <1.43.10
Event History
Sep 29, 2026
CVE Published
via MITRE·10:51 PM
Data Sourced
via MITRE·10:51 PM
DescriptionWeakness
Data Sourced
via NVD·11:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments are affected?
MediaWiki deployments using the Refreshed skin are affected if they run a version earlier than 1.46.1, 1.45.5, or 1.43.10.
2
What must an attacker be able to do to exploit this issue?
The issue is a stored XSS caused by insufficient neutralization of input during web page generation. Exploitation requires attacker-controlled input to be stored and later rendered by the affected Refreshed skin.