CVE-2026-100237 in MediaWiki
Summary
by MITRE • 09/25/2026
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS.
This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The identified security flaw resides within the Wikimedia Foundation's MediaWiki platform, specifically affecting the Thanks extension in versions prior to 1.43.10, 1.45.5, and 1.46.1. This vulnerability is classified as an improper neutralization of input during web page generation, commonly known as cross-site scripting or XSS. The specific manifestation of this flaw allows for stored cross-site scripting attacks, which represent a more severe category of injection vulnerabilities compared to reflected variants due to the persistence of malicious payloads within the application's data store.
The technical root cause lies in the insufficient sanitization and validation mechanisms applied by the Thanks extension when processing user-supplied input that is subsequently rendered back into HTML pages without proper encoding. In typical MediaWiki operations, user interactions such as leaving thank-you messages or comments are stored in a database and later retrieved for display to other users. When this specific extension processes these inputs, it fails to adequately escape special characters that have semantic meaning in HTML, such as angle brackets, ampersands, and quotes. Consequently, an attacker can inject malicious JavaScript code into the input fields associated with the thanks functionality. Because MediaWiki applications often run scripts in a context where they have access to sensitive cookies, session tokens, and user-specific data, this lack of neutralization allows the injected script to execute within the victim's browser session under the authority of the web application.
The operational impact of this stored XSS vulnerability is significant because it does not require complex social engineering tactics involving direct links or phishing emails in many scenarios. Once an attacker successfully injects a payload into a thank message, that malicious code becomes part of the persistent data on the server. Every subsequent user who views the page containing the tainted content will have their browser execute the script automatically. This enables attackers to perform session hijacking by stealing authentication cookies and tokens, allowing them to impersonate legitimate users and gain unauthorized access to accounts with varying levels of privilege. Furthermore, it facilitates account takeover attacks where the attacker can modify settings, post further malicious content, or escalate privileges if they manage to compromise an administrative account through social engineering facilitated by the stolen session data. The vulnerability also supports defacement campaigns where attackers alter the visual presentation of wiki pages and can be used as a vector for delivering malware payloads via drive-by downloads if combined with browser-specific exploits.
From a classification perspective, this issue aligns directly with CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting within the Common Weakness Enumeration framework. The attack methodology corresponds to ATT&CK technique T1059.007: JavaScript Execution on Windows and Linux systems, specifically under the sub-category of client-side scripting. It also relates to CWE-834: Excessive Iteration which may be involved in how the input is processed before rendering, although the primary weakness remains the lack of output encoding. The persistence of the payload places it firmly within the stored XSS category as defined by industry standards for web application security testing.
Mitigation strategies must focus on immediate patching and defensive coding practices. Administrators running affected versions of MediaWiki with the Thanks extension installed should upgrade to version 1.43.10, 1.45.5, or 1.46.1 immediately upon availability. These releases contain code changes that enforce strict output encoding for all user-generated content rendered in HTML contexts. In addition to patching, organizations should implement Content Security Policy headers to restrict the execution of inline scripts and limit script sources to trusted domains, thereby providing a layer of defense even if similar vulnerabilities exist elsewhere in the application stack. Input validation should also be strengthened at the entry point to reject or sanitize potentially dangerous characters before they are stored in the database, although output encoding remains the primary control for preventing XSS. Regular security audits and static code analysis focused on data flow from user input to HTML output can help identify similar flaws in custom extensions or core modifications that may not yet have been patched.