CVE-2026-103438: Various rawParams() and escaped() updates to prevent XSS in Wikistories extension

Published Sep 30, 2026

Updated

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).

This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.

Affected Software

1 affected component

Wikimedia Foundation MediaWiki Wikistories extension=1.46, =1.45, =1.43

Event History

Sep 30, 2026

CVE Published

via MITRE·05:32 PM

Data Sourced

via MITRE·05:32 PM

DescriptionWeakness

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which releases should be checked for exposure?

The issue affects the MediaWiki Wikistories extension versions identified as 1.46, 1.45, and 1.43. Review deployments using any of those releases.

What access and conditions does exploitation require?

The CVSS vector indicates local attacker access, high privileges, high attack complexity, additional attack requirements, and user interaction are required. This is not scored as a remotely exploitable, unauthenticated attack.

CVE-2026-103438: Various rawParams() and escaped() updates to prevent XSS in Wikistories extension

Affected Software

Event History

Frequently Asked Questions

Which releases should be checked for exposure?

What access and conditions does exploitation require?

Company

Resources

Contact

Frequently Asked Questions

Which releases should be checked for exposure?

What access and conditions does exploitation require?