Is CVE-2026-103445 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103445 being exploited in the wild.

How severe is CVE-2026-103445?

Informational severity, published 30 September 2026.

Which products and versions are affected?

Wikimedia Foundation Page Forms 1.43, 1.45, 1.46.

Is there a fix for CVE-2026-103445?

A patch was published on 2026-08-26: Patch merged for master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103445 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103445?

Check whether you run Wikimedia Foundation Page Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103445: MediaWiki Page Forms stored cross-site scripting in autoedit redirect

CVE-2026-103445 · Severity: info · Published 2026-09-30

The Page Forms extension for MediaWiki allows wiki editors to create special links that trigger automated editing workflows. A flaw in how it handles redirect URLs lets editors embed malicious JavaScript code that executes when other users click these links, potentially compromising their accounts or session data. The vulnerability requires edit permissions to the wiki and relies on clicking a specially crafted link.

Vendors: Wikimedia Foundation.

Quick answers

Is CVE-2026-103445 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103445 being exploited in the wild.
How severe is CVE-2026-103445?: Informational severity, published 30 September 2026.
Which products and versions are affected?: Wikimedia Foundation Page Forms 1.43, 1.45, 1.46.
Is there a fix for CVE-2026-103445?: A patch was published on 2026-08-26: Patch merged for master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103445 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103445?: Check whether you run Wikimedia Foundation Page Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Page Forms #autoedit parser function accepts a redirect parameter and inserts it directly into anchor href attributes without URL-scheme validation, enabling javascript: URIs. An authenticated user with edit permissions can save a page containing a malicious autoedit directive; when a visitor views and clicks the link, the attacker's JavaScript executes in the wiki origin with the victim's privileges. The fix applies URL sanitization to reject executable schemes before rendering the anchor.

Affected products

Wikimedia Foundation Page Forms 1.43, 1.45, 1.46

Timeline

2026-08-21: disclosed: Vulnerability reported
2026-08-26: patched: Patch merged for master branch
2026-09-30: advisory: CVE-2026-103445 published
2026-09-29: patched: Patches for REL1_46, REL1_45, REL1_43 branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.