CVE-2026-22710

Published: Jan 9, 2026Modified: Feb 12, 2026

2.3

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (Secondary)

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.

Affected (4)

Products: Wikimedia: Wikibase

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Wikimedia Wikibase	Version 1.39
Wikimedia Wikibase	Version 1.43
Wikimedia Wikibase	Version 1.44
Wikimedia Wikibase	Version 1.45

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://gerrit.wikimedia.org/r/q/I39d0074b2ad022b6efe6ab3dd8c8ec0f86c6c466

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Patch

https://phabricator.wikimedia.org/T409737

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

ExploitIssue Tracking

https://phabricator.wikimedia.org/T409737

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitIssue Tracking

Timeline

No history available yet.