CVE-2026-103438
Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
- Record
CVE-2026-103438- CVSS 4.0
- 0.3 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-80
- Updated
- 2026-11-02
EUVDEUVD-2026-90210
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
- Record
EUVD-2026-90210- CVSS 4.0
- 0.3 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9jgx-vg2f-mrmp
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in...
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
- Record
GHSA-9jgx-vg2f-mrmp- CVSS 4.0
- 0.3 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-80
- Updated
- 2026-11-02
NVD
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
- Record
CVE-2026-103438- CVSS 4.0
- 0.3 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-80
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103438 is a low vulnerability (CVSS 0.3) in The Wikimedia Foundation Mediawiki Wikistories Extension, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. No source names a fixed version.