Product by Open Source
Mediawiki Uploadwizard Extension
14 known vulnerabilities in Mediawiki Uploadwizard Extension (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-100382 | Unauthenticated remote code execution through wikitext in ExternalData | — | |
| High | CVE-2026-57440 | StarCitizenWiki mediawiki-extensions-EmbedVideo: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 7.5 | |
| Medium | CVE-2026-96878 | Cargo Exhibit field alias allows stored XSS | — | |
| Medium | CVE-2026-96877 | Reflected XSS through Cargo Drilldown full-text search | — | |
| Medium | CVE-2026-96876 | Anonymous reflected XSS in CargoExport invalid-alias errors | — | |
| Medium | CVE-2026-96875 | Reflected XSS in Cargo Drilldown hierarchy filters | — | |
| Medium | CVE-2026-100377 | Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract | — | |
| Medium | CVE-2026-96879 | The Wikimedia Foundation Mediawiki - FlaggedRevs extension: Improper Removal of Sensitive Information Before Storage or Transfer | — | |
| Medium | CVE-2026-100380 | Reflected XSS in Wikibase Special:SetLabel language validation | — | |
| Medium | CVE-2026-100381 | UploadWizard Flickr collection and set titles allow DOM XSS | — | |
| Medium | CVE-2026-100237 | Stored i18n XSS in the Flow integration of Thanks | 6.1 | |
| Medium | CVE-2026-100378 | Missing permission check in the Translate sandbox doRemind action | — | |
| Medium | CVE-2026-100376 | Wikimedia Foundation Mediawiki - TemplateSandbox Extension: Cross-site Scripting | — | |
| Low | CVE-2026-96874 | Stored XSS in Cargo Drilldown tab names | — |