Product by Open Source
Mediawiki Wikibase Extension
26 known vulnerabilities in Mediawiki Wikibase Extension (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
26
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-100382 | Unauthenticated remote code execution through wikitext in ExternalData | — | |
| High | CVE-2026-103446 | WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments | — | |
| High | CVE-2026-57440 | StarCitizenWiki mediawiki-extensions-EmbedVideo: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 7.5 | |
| Medium | CVE-2026-96878 | Cargo Exhibit field alias allows stored XSS | — | |
| Medium | CVE-2026-96877 | Reflected XSS through Cargo Drilldown full-text search | — | |
| Medium | CVE-2026-96876 | Anonymous reflected XSS in CargoExport invalid-alias errors | — | |
| Medium | CVE-2026-96875 | Reflected XSS in Cargo Drilldown hierarchy filters | — | |
| High | CVE-2026-103441 | Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing | — | |
| High | CVE-2026-103442 | MergeAccount PHP object injection via session-key substitution | — | |
| Medium | CVE-2026-100377 | Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract | — | |
| Medium | CVE-2026-96879 | The Wikimedia Foundation Mediawiki - FlaggedRevs extension: Improper Removal of Sensitive Information Before Storage or Transfer | — | |
| Medium | CVE-2026-100380 | Reflected XSS in Wikibase Special:SetLabel language validation | — | |
| Medium | CVE-2026-100381 | UploadWizard Flickr collection and set titles allow DOM XSS | — | |
| Medium | CVE-2026-100237 | Stored i18n XSS in the Flow integration of Thanks | 6.1 | |
| Medium | CVE-2026-100378 | Missing permission check in the Translate sandbox doRemind action | — | |
| Medium | CVE-2026-100376 | Wikimedia Foundation Mediawiki - TemplateSandbox Extension: Cross-site Scripting | — | |
| Low | CVE-2026-96874 | Stored XSS in Cargo Drilldown tab names | — | |
| Low | CVE-2026-103444 | Stored XSS through system messages in WikiForum | — | |
| Low | CVE-2026-103585 | attacker-controlled javascript license URL via XSS | — | |
| Low | CVE-2026-103445 | Stored XSS through PageForms #autoedit redirect links | — | |
| Low | CVE-2026-103437 | ReadingLists imported metadata permits JavaScript URL XSS | — | |
| Low | CVE-2026-103440 | pagetriagelist discloses suppressed reviewer usernames | — | |
| Low | CVE-2026-103584 | attacker-controlled javascript license URL via XSS | — | |
| Low | CVE-2026-103443 | API permits session-seeded javascript URL XSS | — | |
| Low | CVE-2026-103439 | Various rawParams() and escaped() updates to prevent XSS in Wikibase extension | — |