CVE-2026-96873: Reflected XSS in CirrusSearch debug explain output
Published Sep 24, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS.
This issue affects Mediawiki - CirrusSearch extension through 1.46.0.
Affected Software
1 affected component
MediaWiki CirrusSearch extension<=1.46.0
Event History
Sep 24, 2026
CVE Published
via MITRE·03:27 PM
Data Sourced
via MITRE·03:27 PM
DescriptionWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
MediaWiki installations using the CirrusSearch extension are affected through version 1.46.0.
2
What should be prioritized for remediation?
Update or otherwise remediate the CirrusSearch extension if it is deployed at version 1.46.0 or earlier. The provided data does not identify a fixed version or a workaround.