CVE-2026-103445 in MediaWiki Page_Forms Extension
Summary
by MITRE • 09/30/2026
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS.
This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified security flaw represents a classic instance of improper neutralization of script-related HTML tags within web pages, commonly categorized under the Common Weakness Enumeration as CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting. This vulnerability specifically impacts the MediaWiki Page_Forms extension developed by The Wikimedia Foundation, affecting versions 1.46, 1.45, and 1.43. The core technical deficiency lies in the application's failure to adequately sanitize or encode user-supplied input before rendering it within HTML contexts. When a user submits data through the form fields managed by this extension, the system processes the input without applying sufficient validation rules to strip out potentially malicious script tags such as JavaScript event handlers or inline scripts. Consequently, any arbitrary code injected into these fields is preserved and executed in the context of the victim's browser session rather than being treated as inert text data.
From an operational perspective, this vulnerability enables Stored Cross-Site Scripting attacks where the malicious payload is permanently stored on the target server within a database record or page content. Unlike reflected XSS which requires tricking a user into clicking a crafted link, stored XSS persists until the vulnerable code is removed from the backend storage. This means that every subsequent user who views the affected page will have their browser execute the injected script automatically. The impact of this execution can be severe depending on the privileges and context of the viewing users. Attackers can leverage this capability to steal session cookies, hijack administrative accounts if they view the compromised content, or perform actions on behalf of legitimate users without authorization. In a wiki environment where collaborative editing is common, an attacker could embed malicious scripts in popular pages, maximizing the number of victims exposed to the exploit and potentially leading to widespread compromise of user sessions across the platform.
The attack vector aligns with several techniques documented in the MITRE ATT&CK framework, particularly T1059 Command and Scripting Interpreter for executing arbitrary code within the browser environment, and T1204 User Execution if social engineering is used to direct users to specific pages containing the payload. Furthermore, the persistence of the data fits the profile of T1189 Drive-by Compromise or more accurately in this context, the manipulation of stored content which facilitates ongoing unauthorized access. The lack of input validation allows for a broad range of payloads including keyloggers, credential harvesters, and defacement scripts that can damage the integrity and reputation of the wiki instance.
Mitigation strategies must focus on implementing robust output encoding and strict input validation mechanisms within the extension's codebase. Developers should ensure that all user-supplied data is encoded according to the context in which it will be rendered, such as HTML entity encoding for text nodes or attribute value escaping for attributes. Additionally, adopting a Content Security Policy can help mitigate the impact of any successful XSS attacks by restricting the sources from which scripts are allowed to load and execute. For administrators using affected versions, immediate steps should include upgrading to a patched version of the MediaWiki Page_Forms extension as soon as it becomes available. In the interim, disabling the specific form features that allow untrusted user input or implementing server-side filtering rules can reduce the risk surface until a permanent code fix is deployed. Regular security audits and penetration testing focused on web application vulnerabilities are recommended to identify similar weaknesses in other components of the MediaWiki infrastructure.