CVE-2026-58034: Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts
Published Jul 1, 2026
·Updated
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.
This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue.
This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.
Affected Software
2 affected components
Wikimedia Foundation CheckUser>1.46.0-rc.0<=1.46.0
MediaWiki MediaWiki=1.46.0-rc0
Event History
Jul 1, 2026
CVE Published
via MITRE·02:21 PM
Data Sourced
via MITRE·02:21 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-58034?
The severity of CVE-2026-58034 is categorized as low with a CVSS score of 4.0.
2
What type of vulnerability is CVE-2026-58034?
CVE-2026-58034 is a Stored Cross-Site Scripting (XSS) vulnerability.
3
How do I fix CVE-2026-58034?
To fix CVE-2026-58034, sanitize and validate all user inputs in the affected system message component.
4
Which software is affected by CVE-2026-58034?
CVE-2026-58034 affects the Wikimedia Foundation CheckUser software.
5
When was CVE-2026-58034 published?
CVE-2026-58034 was published on July 1, 2026.