CVE-2026-103437: ReadingLists imported metadata permits JavaScript URL XSS

Published Sep 30, 2026

Updated

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS.

This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

Affected Software

1 affected component

Wikimedia Foundation MediaWiki ReadingLists extension=1.45, =1.46

Event History

Sep 30, 2026

CVE Published

via MITRE·05:17 PM

Data Sourced

via MITRE·05:17 PM

DescriptionWeakness

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The issue affects the Wikimedia Foundation MediaWiki ReadingLists extension versions 1.45 and 1.46.

What access and interaction are required for exploitation?

The CVSS vector indicates that an attacker needs low privileges and that user interaction is required. The attack can be performed over a network with low attack complexity, with an additional attack requirement present.

CVE-2026-103437: ReadingLists imported metadata permits JavaScript URL XSS

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access and interaction are required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access and interaction are required for exploitation?