Is CVE-2024-23176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-23176 being exploited in the wild.

How severe is CVE-2024-23176?

Medium severity, with a CVSS score of 5.4, published 14 September 2026.

Which products and versions are affected?

Wikimedia MassMessage extension bundled with affected MediaWiki versions.

Is there a fix for CVE-2024-23176?

A patch was published on 2023-12-21: Fixed in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0-rc.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-23176 attacked?

It is attacked over the network.

Am I affected by CVE-2024-23176?

Check whether you run Wikimedia MassMessage extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23176: MediaWiki MassMessage extension XSS in i18n key massmessage-form-page-help

CVE-2024-23176 · Severity: medium · CVSS 5.4 · Published 2026-09-14

The MassMessage extension for MediaWiki, a wiki collaboration platform, contains a cross-site scripting (XSS) vulnerability in its form help text. An attacker can craft a malicious URL with a specially crafted language parameter to inject arbitrary JavaScript code that executes in a user's browser when viewing the MassMessage form, potentially allowing account compromise or unauthorized actions on the wiki.

Vendors: Wikimedia.

Quick answers

Is CVE-2024-23176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-23176 being exploited in the wild.
How severe is CVE-2024-23176?: Medium severity, with a CVSS score of 5.4, published 14 September 2026.
Which products and versions are affected?: Wikimedia MassMessage extension bundled with affected MediaWiki versions.
Is there a fix for CVE-2024-23176?: A patch was published on 2023-12-21: Fixed in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0-rc.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-23176 attacked?: It is attacked over the network.
Am I affected by CVE-2024-23176?: Check whether you run Wikimedia MassMessage extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an i18n-based XSS (information disclosure / code injection) in the MassMessage extension affecting MediaWiki before version 1.40.2. The issue occurs because the massmessage-form-page-help i18n key is rendered without proper escaping when using the 'help' attribute in HTMLFormField, which does not escape HTML content. When an attacker accesses Special:MassMessage with a crafted uselang parameter (e.g., uselang=x-xss), malicious JavaScript embedded in the i18n message is executed. The fix involves using the 'help-message' attribute instead of 'help', which properly escapes content. No authentication is required; the attack is triggered by user interaction with a specially crafted link. Patches are available in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0.

Affected products

Wikimedia MediaWiki before 1.35.14, 1.39.x before 1.39.6, 1.40.x before 1.40.2
Wikimedia MassMessage extension bundled with affected MediaWiki versions

Timeline

2023-09-29: disclosed: Vulnerability reported
2023-12-21: patched: Fixed in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0-rc.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.