CVE-2026-103439 — Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (…
Published: 2026-09-30 · CVSS: 0.3 · CVSS 4.0
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7