CVE-2026-103050: Stored i18n XSS in MassMessage
Published Sep 29, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS.
This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki MassMessage extension<1.46.1, <1.45.5, <1.43.10
Event History
Sep 29, 2026
CVE Published
via MITRE·11:11 PM
Data Sourced
via MITRE·11:11 PM
DescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
DescriptionWeakness
Frequently Asked Questions
1
Which releases should be upgraded to remediate this issue?
Upgrade the MassMessage extension to 1.46.1, 1.45.5, or 1.43.10, as applicable to the MediaWiki release branch in use. Versions earlier than those releases are affected.