Executive brief
The WikiLove extension for MediaWiki, which allows users to send positive appreciation tokens to one another, contains a security vulnerability. An attacker with permissions to edit interface messages can inject malicious scripts into the platform. If successful, this could allow the attacker to execute unauthorized actions in the browsers of other users, potentially leading to account compromise or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the WikiLove extension for MediaWiki due to improper neutralization of alternate XSS syntax in system messages. Specifically, the extension fails to validate URL protocols and performs unsafe string replacements on HTML when building links in components like WikiLoveDialog.vue and wikiLove.js. An attacker with 'editinterface' permissions can modify system messages (such as wikilove-commons-url or wikilove-terms-url) to include 'javascript:' links or event handlers like 'onmouseenter'. When other users interact with the WikiLove interface, the malicious payload executes in their browser context. The issue has been remediated in MediaWiki versions 1.43.7, 1.44.4, and 1.45.2 by sanitizing URLs and using jQuery for safe DOM construction.
Affected products
- The Wikimedia Foundation MediaWiki - WikiLove Extension < 1.43.7, < 1.44.4, < 1.45.2
Timeline
- 2026-02-04: disclosed: Vulnerability reported and task created in Phabricator
- 2026-03-14: patched: Security patches merged into master and release branches
- 2026-04-07: advisory: CVE-2026-22711 published