Product by Open Source
Mediawiki Readinglists Extension
12 known vulnerabilities in Mediawiki Readinglists Extension (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-103446 | WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments | — | |
| High | CVE-2026-103441 | Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing | — | |
| High | CVE-2026-103442 | MergeAccount PHP object injection via session-key substitution | — | |
| Low | CVE-2026-103444 | Stored XSS through system messages in WikiForum | — | |
| Low | CVE-2026-103585 | attacker-controlled javascript license URL via XSS | — | |
| Low | CVE-2026-103445 | Stored XSS through PageForms #autoedit redirect links | — | |
| Low | CVE-2026-103437 | ReadingLists imported metadata permits JavaScript URL XSS | — | |
| Low | CVE-2026-103440 | pagetriagelist discloses suppressed reviewer usernames | — | |
| Low | CVE-2026-103584 | attacker-controlled javascript license URL via XSS | — | |
| Low | CVE-2026-103443 | API permits session-seeded javascript URL XSS | — | |
| Low | CVE-2026-103439 | Various rawParams() and escaped() updates to prevent XSS in Wikibase extension | — | |
| Low | CVE-2026-103438 | Various rawParams() and escaped() updates to prevent XSS in Wikistories extension | — |