Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS.
This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10.
This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 29 Sep 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10. | |
| Title | Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS | |
| Weaknesses | CWE-79 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: wikimedia-foundation
Published:
Updated: 2026-09-29T16:12:06.871Z
Reserved: 2026-09-25T16:02:34.842Z
Link: CVE-2026-100238
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-29T17:17:00.873
Modified: 2026-09-29T17:17:00.873
Link: CVE-2026-100238
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses