CVE-2026-103445: Stored XSS through PageForms #autoedit redirect links
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.
This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43.
Affected Software
Event History
Frequently Asked Questions
What access and conditions are required for exploitation?
The CVSS vector indicates network access, low attack complexity, low privileges, user interaction, and additional attack requirements are needed. It is not described as exploitable by an unauthenticated attacker.
Which installations should be checked?
Check deployments using the MediaWiki Page Forms extension on versions 1.46, 1.45, or 1.43. The provided information does not identify affected patch-level releases within those version lines.
How can I determine whether my deployment is affected?
Verify whether the installed Page Forms extension version is in the 1.46, 1.45, or 1.43 release lines. The available information does not provide a detection method, indicator of compromise, or configuration-based test.