# CVE-2024-23176: MediaWiki MassMessage extension XSS in i18n key massmessage-form-page-help

Source: https://junglewise.ai/threats/cve-2024-23176-mediawiki-massmessage-extension-xss-in-i18n-key-massmessage-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-23176 · Severity: medium · CVSS 5.4 · Published 2026-09-14

The MassMessage extension for MediaWiki, a wiki collaboration platform, contains a cross-site scripting (XSS) vulnerability in its form help text. An attacker can craft a malicious URL with a specially crafted language parameter to inject arbitrary JavaScript code that executes in a user's browser when viewing the MassMessage form, potentially allowing account compromise or unauthorized actions on the wiki.

Vendors: [Wikimedia](https://junglewise.ai/threats/vendors/wikimedia).

## Quick answers

**Is CVE-2024-23176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-23176 being exploited in the wild.

**How severe is CVE-2024-23176?** Medium severity, with a CVSS score of 5.4, published 14 September 2026.

**Which products and versions are affected?** Wikimedia MassMessage extension bundled with affected MediaWiki versions.

**Is there a fix for CVE-2024-23176?** A patch was published on 2023-12-21: Fixed in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0-rc.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-23176 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-23176?** Check whether you run Wikimedia MassMessage extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an i18n-based XSS (information disclosure / code injection) in the MassMessage extension affecting MediaWiki before version 1.40.2. The issue occurs because the massmessage-form-page-help i18n key is rendered without proper escaping when using the 'help' attribute in HTMLFormField, which does not escape HTML content. When an attacker accesses Special:MassMessage with a crafted uselang parameter (e.g., uselang=x-xss), malicious JavaScript embedded in the i18n message is executed. The fix involves using the 'help-message' attribute instead of 'help', which properly escapes content. No authentication is required; the attack is triggered by user interaction with a specially crafted link. Patches are available in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0.

## Affected products

- Wikimedia MediaWiki before 1.35.14, 1.39.x before 1.39.6, 1.40.x before 1.40.2
- Wikimedia MassMessage extension bundled with affected MediaWiki versions

## Timeline

- 2023-09-29: disclosed: Vulnerability reported
- 2023-12-21: patched: Fixed in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0-rc.0

## References

- [https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/TDBUBCCOQJUT4SCHJNPHKQNPBUUETY52/](https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/TDBUBCCOQJUT4SCHJNPHKQNPBUUETY52/)
- [https://phabricator.wikimedia.org/T347742](https://phabricator.wikimedia.org/T347742)