CVE-2026-103438: Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
Published Sep 30, 2026
·Updated
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki Wikistories extension=1.46, =1.45, =1.43
Event History
Sep 30, 2026
CVE Published
via MITRE·05:32 PM
Data Sourced
via MITRE·05:32 PM
DescriptionWeakness
Data Sourced
via NVD·06:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which releases should be checked for exposure?
The issue affects the MediaWiki Wikistories extension versions identified as 1.46, 1.45, and 1.43. Review deployments using any of those releases.
2
What access and conditions does exploitation require?
The CVSS vector indicates local attacker access, high privileges, high attack complexity, additional attack requirements, and user interaction are required. This is not scored as a remotely exploitable, unauthenticated attack.