CVE-2026-100245

Name of the Vulnerable Software and Affected Versions Mediawiki - Wikibase Extension versions prior to 1.46.1 Mediawiki - Wikibase Extension version 1.45.5 Mediawiki - Wikibase Extension version 1.43.10

Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server. The issue occurs on the 'Special:SetSiteLink' endpoint due to an unescaped system message.

Recommendations Update Mediawiki - Wikibase Extension to version 1.46.1 or later. Update Mediawiki - Wikibase Extension to a version newer than 1.45.5. Update Mediawiki - Wikibase Extension to a version newer than 1.43.10.