CVE-2026-103585 LOW

CVE-2026-103585: attacker-controlled javascript license URL via XSS

Vendor The Wikimedia Foundation
Product MediaWiki MediaSearch extension
Weakness CWE-80 · XSS · basic
Published September 30, 2026
Last update October 1, 2026
View on NVD All CVEs

CVSS base score

1.2/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

What the vulnerability does

01Description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

Key dates

02Disclosure timeline

September 30, 2026 CVE published
October 1, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14792 Key Figures <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render CVE-2025-49398 WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability CVE-2026-28132 WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability CVE-2025-11745 Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVE-2026-22469 WordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerability