# CVE-2026-100245: Mediawiki Wikibase Extension stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-100245-improper-neutralization-of-input-during-web-page-generation-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-100245 · Severity: info · Published 2026-09-29

Mediawiki's Wikibase Extension, which allows structured data management in wikis, contains a flaw that allows attackers to inject malicious scripts into page content. An attacker can inject stored XSS payloads that execute in the browsers of other users viewing affected pages, potentially leading to credential theft, session hijacking, or unauthorized actions on behalf of victims.

Technologies: [Wikimedia Foundation MediaWiki](https://junglewise.ai/threats/technologies/mediawiki). Vendors: [Wikimedia Foundation](https://junglewise.ai/threats/vendors/wikimedia-foundation).

## Quick answers

**Is CVE-2026-100245 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100245 being exploited in the wild.

**How severe is CVE-2026-100245?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Wikimedia Foundation MediaWiki before 1.46.1, 1.45.5, 1.43.10; Wikimedia Foundation Wikibase Extension before 1.46.1, 1.45.5, 1.43.10.

**Is there a fix for CVE-2026-100245?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100245 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100245?** Check whether you run Wikimedia Foundation MediaWiki or Wikimedia Foundation Wikibase Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Improper input neutralization in the Wikibase Extension fails to sanitize user input during web page generation, allowing stored cross-site scripting (XSS) attacks. An attacker can inject JavaScript that persists in the wiki database and executes for all users who view the affected page content. This vulnerability affects Mediawiki versions before 1.46.1, 1.45.5, and 1.43.10.

## Affected products

- Wikimedia Foundation Mediawiki before 1.46.1, 1.45.5, 1.43.10
- Wikimedia Foundation Wikibase Extension before 1.46.1, 1.45.5, 1.43.10

## Timeline

- 2026-09-29: disclosed

## References

- [https://gerrit.wikimedia.org/r/q/If871fa7684d42dae057c0517d4a17132cd7aefeb](https://gerrit.wikimedia.org/r/q/If871fa7684d42dae057c0517d4a17132cd7aefeb)
- [https://phabricator.wikimedia.org/T432877](https://phabricator.wikimedia.org/T432877)

## Related threats

- [Wikimedia Mediawiki UploadWizard DOM XSS in Flickr titles](https://junglewise.ai/threats/cve-2026-100381-improper-neutralization-of-input-during-web-page-generation-xss)
- [MediaWiki Wikibase reflected XSS in Special:SetLabel](https://junglewise.ai/threats/cve-2026-100380-improper-neutralization-of-input-during-web-page-generation-xss)
- [Wikimedia Foundation MediaWiki XSS in Logging and Special Pages](https://junglewise.ai/threats/cve-2026-58037-wikimedia-foundation-mediawiki-xss-in-logging-and-special-pages)
- [Wikimedia Foundation MediaWiki Information Exposure in User API](https://junglewise.ai/threats/cve-2026-58036-wikimedia-foundation-mediawiki-information-exposure-in-user-api)
- [Wikimedia Foundation MediaWiki information disclosure in InfoAction](https://junglewise.ai/threats/cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in)