Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Medi…

Medium CVSS 6.1

CVECVE-2026-100237

First seen2026-09-25 19:16 UTC

Disclosed2026-09-25 17:17 UTC

Last updated2026-09-25 19:16 UTC

Channel statusauto

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://gerrit.wikimedia.org/r/q/I6d563f9cdab25c07dcd0083f3af2126e0859d098
https://phabricator.wikimedia.org/T432424

Timeline

2026-09-25 nvd_ingest NVD