CVE-2026-100238

Name of the Vulnerable Software and Affected Versions Mediawiki - Flow Extension versions prior to 1.46.1 Mediawiki - Flow Extension version 1.45.5 Mediawiki - Flow Extension version 1.43.10

Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and served to other users.

Recommendations Update Mediawiki - Flow Extension to version 1.46.1 or later. Update Mediawiki - Flow Extension to a version newer than 1.45.5. Update Mediawiki - Flow Extension to a version newer than 1.43.10.