Is CVE-2026-52854 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52854 being exploited in the wild.

How severe is CVE-2026-52854?

High severity, with a CVSS score of 8.6, published 18 August 2026.

Which products and versions are affected?

mediawiki/maps (Packagist) < 12.1.3, ECOSYSTEM:introduced=0,fixed=12.1.3.

Is there a fix for CVE-2026-52854?

Yes. mediawiki/maps (Packagist): upgrade to 12.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52854 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-52854?

Check whether you run mediawiki/maps (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52854: ProfessionalWiki Maps stored XSS in display_map parser function

Q: Is there a fix for CVE-2026-52854?

Yes. mediawiki/maps (Packagist): upgrade to 12.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52854 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-52854?

Check whether you run mediawiki/maps (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52854 · Severity: high · CVSS 8.6 · Published 2026-08-18

The Maps extension for MediaWiki, which allows users to embed interactive maps into wiki pages, is vulnerable to a security flaw that allows attackers to inject malicious scripts. By adding specially crafted text to a map's overlay settings, an attacker can execute code in the browsers of other users who view the map. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Vendors: Packagist.

Quick answers

Is CVE-2026-52854 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52854 being exploited in the wild.
How severe is CVE-2026-52854?: High severity, with a CVSS score of 8.6, published 18 August 2026.
Which products and versions are affected?: mediawiki/maps (Packagist) < 12.1.3, ECOSYSTEM:introduced=0,fixed=12.1.3.
Is there a fix for CVE-2026-52854?: Yes. mediawiki/maps (Packagist): upgrade to 12.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52854 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-52854?: Check whether you run mediawiki/maps (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mediawiki/maps (Packagist): upgrade to 12.1.3 or later
```
composer require mediawiki/maps:^12.1.3
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the ProfessionalWiki Maps extension for MediaWiki (mediawiki/maps). The vulnerability is located in the `display_map` parser function when the Leaflet service is utilized. The extension fails to properly escape overlay names provided in the `overlays` parameter before passing them to the Leaflet library, which subsequently renders them as raw HTML. An attacker with page editing permissions can exploit this by embedding malicious HTML/JavaScript in the wikitext. The issue is addressed in version 12.1.3.

Affected products

ProfessionalWiki Maps < 12.1.3

Identifiers

CVE-2026-52854
GHSA-4h7g-5542-v3fc

Timeline

2026-05-28: disclosed
2026-07-02: advisory
2026-07-02: patched: Fixed in version 12.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.