# CVE-2026-100380: MediaWiki Wikibase reflected XSS in Special:SetLabel

Source: https://junglewise.ai/threats/cve-2026-100380-improper-neutralization-of-input-during-web-page-generation-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100380 · Severity: info · Published 2026-09-25

MediaWiki is a popular wiki engine that powers Wikipedia and other wikis. The Wikibase extension, which manages structured data in wikis, contains a cross-site scripting (XSS) vulnerability in the Special:SetLabel page where user-supplied language parameters are not properly sanitized. An attacker can craft a malicious link or form that, when visited by a wiki user, executes arbitrary JavaScript in the user's browser, potentially stealing credentials or session tokens.

Technologies: [Wikimedia Foundation MediaWiki](https://junglewise.ai/threats/technologies/mediawiki). Vendors: [Wikimedia Foundation](https://junglewise.ai/threats/vendors/wikimedia-foundation).

## Quick answers

**Is CVE-2026-100380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100380 being exploited in the wild.

**How severe is CVE-2026-100380?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** Wikimedia Foundation MediaWiki before 1.46.1, 1.45.5, 1.43.10; Wikimedia Foundation Wikibase before 1.46.1, 1.45.5, 1.43.10.

**Is there a fix for CVE-2026-100380?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100380 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100380?** Check whether you run Wikimedia Foundation MediaWiki or Wikimedia Foundation Wikibase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected XSS vulnerability exists in Special:SetLabel where language validation error messages fail to HTML-escape user input, allowing arbitrary script injection. The vulnerability is triggered via the language parameter and can be exploited by unauthenticated attackers through a crafted URL or HTML form without additional user interaction beyond visiting the page. The fix involves HTML-escaping error messages in the affected special pages (SetLabel and others).

## Affected products

- Wikimedia Foundation MediaWiki before 1.46.1, 1.45.5, 1.43.10
- Wikimedia Foundation Wikibase before 1.46.1, 1.45.5, 1.43.10

## Timeline

- 2026-08-11: disclosed
- 2026-09-25: disclosed

## References

- [https://gerrit.wikimedia.org/r/q/I7407f9748d72161ce25ad0ba2446869bb1776857](https://gerrit.wikimedia.org/r/q/I7407f9748d72161ce25ad0ba2446869bb1776857)
- [https://phabricator.wikimedia.org/T434549](https://phabricator.wikimedia.org/T434549)

## Related threats

- [Mediawiki Wikibase Extension stored cross-site scripting](https://junglewise.ai/threats/cve-2026-100245-improper-neutralization-of-input-during-web-page-generation-xss)
- [Wikimedia Mediawiki UploadWizard DOM XSS in Flickr titles](https://junglewise.ai/threats/cve-2026-100381-improper-neutralization-of-input-during-web-page-generation-xss)
- [Wikimedia Foundation MediaWiki XSS in Logging and Special Pages](https://junglewise.ai/threats/cve-2026-58037-wikimedia-foundation-mediawiki-xss-in-logging-and-special-pages)
- [Wikimedia Foundation MediaWiki Information Exposure in User API](https://junglewise.ai/threats/cve-2026-58036-wikimedia-foundation-mediawiki-information-exposure-in-user-api)
- [Wikimedia Foundation MediaWiki information disclosure in InfoAction](https://junglewise.ai/threats/cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in)