Changeflow GovPing Data Privacy & Cybersecurity MediaWiki Extensions XSS Vulnerability, CVSS 8.3
Priority review Guidance Added Final

MediaWiki Extensions XSS Vulnerability, CVSS 8.3

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published
Detected
Email

Summary

CERT-Bund issued security advisory WID-SEC-2026-1043 warning of multiple cross-site scripting (XSS) vulnerabilities in MediaWiki extensions. Affected versions include MediaWiki prior to 1.43.7, 1.44.4, and 1.45.2, along with 8 extensions including Wikilove, ProofreadPage, Cargo, ReportIncident, GrowthExperiments, CampaignEvents, Score, and CentralAuth. The vulnerability has a CVSS Base Score of 8.3 (high) and temporal score of 7.2 (high). Remote attack is possible.

View original document View source feed page

What changed

CERT-Bund published a security advisory identifying multiple XSS vulnerabilities in MediaWiki and 8 extensions (Wikilove, ProofreadPage, Cargo, ReportIncident, GrowthExperiments, CampaignEvents, Score, CentralAuth). The vulnerabilities allow remote attackers to conduct cross-site scripting attacks. CVSS Base Score is 8.3 (high) with temporal score of 7.2.

Organizations running MediaWiki installations should prioritize updating to patched versions (1.43.7+, 1.44.4+, 1.45.2+) and apply mitigations for affected extensions. System administrators and IT security teams managing MediaWiki deployments should assess exposure and implement patches promptly.

What to do next

  1. Update MediaWiki to version 1.43.7, 1.44.4, 1.45.2 or later
  2. Apply available mitigations for affected extensions
  3. Monitor for CVE updates for affected MediaWiki extensions

Archived snapshot

Apr 11, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

[WID-SEC-2026-1043] MediaWiki Erweiterungen: Mehrere Schwachstellen ermöglichen Cross-Site Scripting CVSS Base Score 8.3 (hoch) CVSS Temporal Score 7.2 (hoch) Remoteangriff ja Datum 09.04.2026 Stand 10.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • Sonstiges
  • UNIX
  • Windows

Produktbeschreibung

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Produkte

09.04.2026
- Open Source MediaWiki <1.43.7

  • Open Source MediaWiki <1.44.4

  • Open Source MediaWiki <1.45.2

  • Open Source MediaWiki Wikilove Extension

  • Open Source MediaWiki ProofreadPage Extension

  • Open Source MediaWiki Cargo Extension

  • Open Source MediaWiki ReportIncident Extension

  • Open Source MediaWiki GrowthExperiments Extension

  • Open Source MediaWiki CampaignEvents Extension

  • Open Source MediaWiki Score Extension

  • Open Source MediaWiki CentralAuth Extension

Angriff

Angriff

Ein Angreifer kann mehrere Schwachstellen in MediaWiki Extensions ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben

Related changes

Favicon for wid.cert-bund.de FasterXML Jackson Vulnerability - Security Bypass (CVSS 7.5)
Priority review Apr 08, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Keycloak Information Disclosure Vulnerability (CVSS 3.7)
Priority review Apr 08, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de OpenClaw Multiple Vulnerabilities CVSS 6.3 Affecting Linux/UNIX
Routine Apr 09, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-Bund Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for wid.cert-bund.de
CERT-Bund Security Advisories wid.cert-bund.de/content/public/securityAdvisory/rss
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-Bund
Published
April 9th, 2026
Instrument
Guidance
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
WID-SEC-2026-1043

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Software vulnerability response Security patching
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Software & Technology

Browse Categories

Agriculture & Food Safety 64 AI Regulation 3 Banking & Finance 292 Consumer Protection 44 Courts & Legal 362 Data Privacy & Cybersecurity 74 Defense & National Security 52 Education 19 Energy 101 Environment 86 Environmental Regulation 8 Financial Regulation 2 Government & Legislation 280 Healthcare 136 Housing 16 Immigration 8 Insurance 58 Labor & Employment 113 Pharma & Drug Safety 104 Public Health 3 Securities & Markets 104 Securities Regulation 9 Tax 66 Telecom & Technology 47 Trade & Sanctions 136 Transportation 57

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!