Product by The Wikimedia Foundation
Mediawiki - Wikilambda Extension
23 known vulnerabilities in Mediawiki - Wikilambda Extension (The Wikimedia Foundation), 0 of them actively exploited (CISA KEV).
Key figures
23
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-103446 | WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments | — | |
| Medium | CVE-2026-96878 | Cargo Exhibit field alias allows stored XSS | — | |
| Medium | CVE-2026-96877 | Reflected XSS through Cargo Drilldown full-text search | — | |
| Medium | CVE-2026-96876 | Anonymous reflected XSS in CargoExport invalid-alias errors | — | |
| Medium | CVE-2026-96875 | Reflected XSS in Cargo Drilldown hierarchy filters | — | |
| High | CVE-2026-103441 | Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing | — | |
| High | CVE-2026-103442 | MergeAccount PHP object injection via session-key substitution | — | |
| Medium | CVE-2026-96879 | The Wikimedia Foundation Mediawiki - FlaggedRevs extension: Improper Removal of Sensitive Information Before Storage or Transfer | — | |
| Medium | CVE-2026-103046 | WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML | 6.1 | |
| Medium | CVE-2026-100237 | Stored i18n XSS in the Flow integration of Thanks | 6.1 | |
| Medium | CVE-2026-58517 | Blocked users can create and edit WikiLambda objects | 4.3 | |
| Medium | CVE-2025-62695 | Stored XSS through system messages | — | |
| Low | CVE-2026-96872 | The Wikimedia Foundation Mediawiki - WikiLambda Extension: Improper Handling of Insufficient Permissions or Privileges | — | |
| Low | CVE-2026-96874 | Stored XSS in Cargo Drilldown tab names | — | |
| Low | CVE-2026-103444 | Stored XSS through system messages in WikiForum | — | |
| Low | CVE-2026-103585 | attacker-controlled javascript license URL via XSS | — | |
| Low | CVE-2026-103445 | Stored XSS through PageForms #autoedit redirect links | — | |
| Low | CVE-2026-103437 | ReadingLists imported metadata permits JavaScript URL XSS | — | |
| Low | CVE-2026-103440 | pagetriagelist discloses suppressed reviewer usernames | — | |
| Low | CVE-2026-103584 | attacker-controlled javascript license URL via XSS | — | |
| Low | CVE-2026-103443 | API permits session-seeded javascript URL XSS | — | |
| Low | CVE-2026-103439 | Various rawParams() and escaped() updates to prevent XSS in Wikibase extension | — | |
| Low | CVE-2026-103438 | Various rawParams() and escaped() updates to prevent XSS in Wikistories extension | — |