CVE-2026-103445: Stored XSS through PageForms #autoedit redirect links

Published Sep 30, 2026

Updated

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.

This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43.

Affected Software

1 affected component

Wikimedia Foundation MediaWiki Page Forms=1.46, =1.45, =1.43

Event History

Sep 30, 2026

CVE Published

via MITRE·05:04 PM

Data Sourced

via MITRE·05:04 PM

DescriptionWeakness

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and conditions are required for exploitation?

The CVSS vector indicates network access, low attack complexity, low privileges, user interaction, and additional attack requirements are needed. It is not described as exploitable by an unauthenticated attacker.

Which installations should be checked?

Check deployments using the MediaWiki Page Forms extension on versions 1.46, 1.45, or 1.43. The provided information does not identify affected patch-level releases within those version lines.

How can I determine whether my deployment is affected?

Verify whether the installed Page Forms extension version is in the 1.46, 1.45, or 1.43 release lines. The available information does not provide a detection method, indicator of compromise, or configuration-based test.

CVE-2026-103445: Stored XSS through PageForms #autoedit redirect links

Affected Software

Event History

Frequently Asked Questions

What access and conditions are required for exploitation?

Which installations should be checked?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What access and conditions are required for exploitation?

Which installations should be checked?

How can I determine whether my deployment is affected?