CVE-2026-103584 LOW

CVE-2026-103584: attacker-controlled javascript license URL via XSS

Vendor The Wikimedia Foundation
Product MediaWiki CommonsMetadata extension
Weakness CWE-80 · XSS · basic
Published September 30, 2026
Last update October 1, 2026
View on NVD All CVEs

CVSS base score

1.1/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

What the vulnerability does

01Description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.

Key dates

02Disclosure timeline

September 30, 2026 CVE published
October 1, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14835 WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting CVE-2025-11987 Visual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode CVE-2025-14735 Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2026-22422 WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability CVE-2025-64633 WordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability