CVE-2026-103585: attacker-controlled javascript license URL via XSS

Published Sep 30, 2026

Updated

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS).

This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

Affected Software

1 affected component

Wikimedia Foundation MediaWiki MediaSearch extension=1.46, =1.45, =1.43

Event History

Sep 30, 2026

CVE Published

via MITRE·10:17 PM

Data Sourced

via MITRE·10:17 PM

DescriptionWeakness

Data Sourced

via NVD·11:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which MediaSearch versions are affected?

The issue affects the MediaWiki MediaSearch extension versions 1.46, 1.45, and 1.43.

What access and interaction are required for exploitation?

The CVSS vector indicates network-reachable exploitation with low attack complexity, but requires low privileges and user interaction. The vector also indicates an additional attacker precondition.

What is the potential impact if exploitation succeeds?

Successful exploitation can have low impact on confidentiality, integrity, and availability for both the vulnerable system and subsequent systems, according to the CVSS vector.

CVE-2026-103585: attacker-controlled javascript license URL via XSS

Affected Software

Event History

Frequently Asked Questions

Which MediaSearch versions are affected?

What access and interaction are required for exploitation?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which MediaSearch versions are affected?

What access and interaction are required for exploitation?

What is the potential impact if exploitation succeeds?