Product by The Wikimedia Foundation
Mediawiki - Centralauth Extension
15 known vulnerabilities in Mediawiki - Centralauth Extension (The Wikimedia Foundation), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-103446 | WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments | — | |
| High | CVE-2026-103441 | Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing | — | |
| High | CVE-2026-103442 | MergeAccount PHP object injection via session-key substitution | — | |
| High | CVE-2026-39937 | Global vanishing does not completely remove user email | — | |
| Medium | CVE-2025-62669 | UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks | — | |
| Medium | CVE-2026-103047 | XSS through i18n message in CentralAuth | 6.1 | |
| Low | CVE-2026-103444 | Stored XSS through system messages in WikiForum | — | |
| Low | CVE-2026-103445 | Stored XSS through PageForms #autoedit redirect links | — | |
| Low | CVE-2026-103585 | attacker-controlled javascript license URL via XSS | — | |
| Low | CVE-2026-103437 | ReadingLists imported metadata permits JavaScript URL XSS | — | |
| Low | CVE-2026-103584 | attacker-controlled javascript license URL via XSS | — | |
| Low | CVE-2026-103440 | pagetriagelist discloses suppressed reviewer usernames | — | |
| Low | CVE-2026-103443 | API permits session-seeded javascript URL XSS | — | |
| Low | CVE-2026-103439 | Various rawParams() and escaped() updates to prevent XSS in Wikibase extension | — | |
| Low | CVE-2026-103438 | Various rawParams() and escaped() updates to prevent XSS in Wikistories extension | — |