PT-2026-91064 · Mediawiki · Massmessage
CVE-2024-23176
·
Published
2026-09-14
·
Updated
2026-09-28
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
MassMessage extension in MediaWiki versions prior to 1.40.2
Description
A Cross-Site Scripting (XSS) issue exists in the MassMessage extension. The problem occurs when using the
Special:MassMessage endpoint with the uselang parameter set to a malicious value, which allows the massmessage-form-page-help i18n key to execute arbitrary scripts.Recommendations
Update the MassMessage extension to version 1.40.2 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Massmessage