CVE-2026-103437: ReadingLists imported metadata permits JavaScript URL XSS
Published Sep 30, 2026
·Updated
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS.
This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki ReadingLists extension=1.45, =1.46
Event History
Sep 30, 2026
CVE Published
via MITRE·05:17 PM
Data Sourced
via MITRE·05:17 PM
DescriptionWeakness
Data Sourced
via NVD·06:18 PM
DescriptionSeverityWeakness
Exploit Published
via GitHub·06:33 PM
Frequently Asked Questions
1
Which deployments are affected?
The issue affects the Wikimedia Foundation MediaWiki ReadingLists extension versions 1.45 and 1.46.
2
What access and interaction are required for exploitation?
The CVSS vector indicates that an attacker needs low privileges and that user interaction is required. The attack can be performed over a network with low attack complexity, with an additional attack requirement present.