# Wikimedia Foundation Mediawiki vulnerabilities Source: https://junglewise.ai/threats/technologies/mediawiki Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mediawiki.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 21 vulnerabilities in Wikimedia Foundation Mediawiki: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100245, was published on 29 September 2026. Nothing in the last four weeks, down from 4 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 21 (0 critical, 0 exploited in the wild) ## About Wikimedia Foundation Mediawiki MediaWiki is a free and open-source wiki software platform used to power collaborative online encyclopedias and knowledge bases. ## Latest Wikimedia Foundation Mediawiki vulnerabilities - [CVE-2026-100245: Mediawiki Wikibase Extension stored cross-site scripting](https://junglewise.ai/threats/cve-2026-100245-improper-neutralization-of-input-during-web-page-generation-xss) (info, published 29 Sep 2026) - [CVE-2026-100381: Wikimedia Mediawiki UploadWizard DOM XSS in Flickr titles](https://junglewise.ai/threats/cve-2026-100381-improper-neutralization-of-input-during-web-page-generation-xss) (info, published 25 Sep 2026) - [CVE-2026-100380: MediaWiki Wikibase reflected XSS in Special:SetLabel](https://junglewise.ai/threats/cve-2026-100380-improper-neutralization-of-input-during-web-page-generation-xss) (info, published 25 Sep 2026) - [CVE-2023-37252: MediaWiki CheckUser extension information disclosure in log](https://junglewise.ai/threats/cve-2023-37252-mediawiki-checkuser-extension-information-disclosure-in-log) (low, CVSS 3.1, published 14 Sep 2026) - [CVE-2026-58037: Wikimedia Foundation MediaWiki XSS in Logging and Special Pages](https://junglewise.ai/threats/cve-2026-58037-wikimedia-foundation-mediawiki-xss-in-logging-and-special-pages) (info, CVSS 0, published 1 Jul 2026) - [CVE-2026-58036: Wikimedia Foundation MediaWiki Information Exposure in User API](https://junglewise.ai/threats/cve-2026-58036-wikimedia-foundation-mediawiki-information-exposure-in-user-api) (info, CVSS 2.1, published 1 Jul 2026) - [CVE-2026-58033: Wikimedia Foundation MediaWiki information disclosure in InfoAction](https://junglewise.ai/threats/cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in) (info, CVSS 5.3, published 1 Jul 2026) - [CVE-2026-58032: Wikimedia Foundation MediaWiki XSS in mediawiki.Api component](https://junglewise.ai/threats/cve-2026-58032-wikimedia-foundation-mediawiki-xss-in-mediawiki-api-component) (info, CVSS 5.3, published 1 Jul 2026) - [CVE-2026-58029: Wikimedia Foundation MediaWiki improper authentication in account management components](https://junglewise.ai/threats/cve-2026-58029-wikimedia-foundation-mediawiki-improper-authentication-in-account) (info, CVSS 5.3, published 1 Jul 2026) - [CVE-2026-58028: Wikimedia Foundation MediaWiki and CentralAuth XSS](https://junglewise.ai/threats/cve-2026-58028-wikimedia-foundation-mediawiki-and-centralauth-xss) (info, CVSS 0, published 1 Jul 2026) - [CVE-2026-58026: Wikimedia Foundation MediaWiki information disclosure in Parser.php](https://junglewise.ai/threats/cve-2026-58026-wikimedia-foundation-mediawiki-information-disclosure-in-parser) (info, CVSS 0, published 1 Jul 2026) - [CVE-2026-58025: Wikimedia Foundation MediaWiki deserialization in WikiImporter](https://junglewise.ai/threats/cve-2026-58025-wikimedia-foundation-mediawiki-deserialization-in-wikiimporter) (info, CVSS 5.9, published 1 Jul 2026) - [CVE-2026-58024: Wikimedia Foundation MediaWiki information disclosure in ApiUserrights](https://junglewise.ai/threats/cve-2026-58024-wikimedia-foundation-mediawiki-information-disclosure-in) (info, CVSS 5.1, published 1 Jul 2026) - [CVE-2026-58035: Wikimedia Foundation MediaWiki XSS in SpecialBlock.Vue](https://junglewise.ai/threats/cve-2026-58035-wikimedia-foundation-mediawiki-xss-in-specialblock-vue) (info, CVSS 0, published 1 Jul 2026) - [CVE-2026-58031: Wikimedia Foundation MediaWiki XSS in ApiSandboxLayout](https://junglewise.ai/threats/cve-2026-58031-wikimedia-foundation-mediawiki-xss-in-apisandboxlayout) (info, CVSS 0, published 1 Jul 2026) - [CVE-2026-34095: Wikimedia Foundation MediaWiki incorrect Content-Type in ActionEntryPoint](https://junglewise.ai/threats/cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in) (medium, CVSS 6.1, published 11 May 2026) - [CVE-2026-34094: Wikimedia Foundation MediaWiki JavaScript injection in page protection indicators](https://junglewise.ai/threats/cve-2026-34094-wikimedia-foundation-mediawiki-javascript-injection-in-page) (low, CVSS 3.8, published 11 May 2026) - [CVE-2026-34093: Wikimedia Foundation MediaWiki sensitive information exposure in SpecialUserRights](https://junglewise.ai/threats/cve-2026-34093-wikimedia-foundation-mediawiki-sensitive-information-exposure-in) (medium, CVSS 5.3, published 11 May 2026) - [CVE-2026-34092: Wikimedia Foundation MediaWiki information disclosure in Skin.php](https://junglewise.ai/threats/cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34091: Wikimedia Foundation MediaWiki sensitive information disclosure](https://junglewise.ai/threats/cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34088: Wikimedia Foundation MediaWiki sensitive information exposure](https://junglewise.ai/threats/cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure) (high, CVSS 7.5, published 11 May 2026) ## Most severe Wikimedia Foundation Mediawiki vulnerabilities - [CVE-2026-34092: Wikimedia Foundation MediaWiki information disclosure in Skin.php](https://junglewise.ai/threats/cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34091: Wikimedia Foundation MediaWiki sensitive information disclosure](https://junglewise.ai/threats/cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34088: Wikimedia Foundation MediaWiki sensitive information exposure](https://junglewise.ai/threats/cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34095: Wikimedia Foundation MediaWiki incorrect Content-Type in ActionEntryPoint](https://junglewise.ai/threats/cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in) (medium, CVSS 6.1, published 11 May 2026) - [CVE-2026-34093: Wikimedia Foundation MediaWiki sensitive information exposure in SpecialUserRights](https://junglewise.ai/threats/cve-2026-34093-wikimedia-foundation-mediawiki-sensitive-information-exposure-in) (medium, CVSS 5.3, published 11 May 2026) - [CVE-2026-34094: Wikimedia Foundation MediaWiki JavaScript injection in page protection indicators](https://junglewise.ai/threats/cve-2026-34094-wikimedia-foundation-mediawiki-javascript-injection-in-page) (low, CVSS 3.8, published 11 May 2026) - [CVE-2023-37252: MediaWiki CheckUser extension information disclosure in log](https://junglewise.ai/threats/cve-2023-37252-mediawiki-checkuser-extension-information-disclosure-in-log) (low, CVSS 3.1, published 14 Sep 2026) - [CVE-2026-58025: Wikimedia Foundation MediaWiki deserialization in WikiImporter](https://junglewise.ai/threats/cve-2026-58025-wikimedia-foundation-mediawiki-deserialization-in-wikiimporter) (info, CVSS 5.9, published 1 Jul 2026) - [CVE-2026-58033: Wikimedia Foundation MediaWiki information disclosure in InfoAction](https://junglewise.ai/threats/cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in) (info, CVSS 5.3, published 1 Jul 2026) - [CVE-2026-58032: Wikimedia Foundation MediaWiki XSS in mediawiki.Api component](https://junglewise.ai/threats/cve-2026-58032-wikimedia-foundation-mediawiki-xss-in-mediawiki-api-component) (info, CVSS 5.3, published 1 Jul 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 4 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Wikimedia Foundation technologies - [Wikimedia Foundation Cargo Extension](https://junglewise.ai/threats/technologies/cargo-extension): 4 vulnerabilities - [Wikimedia Foundation Mediawiki WikiLambda extension](https://junglewise.ai/threats/technologies/mediawiki-wikilambda-extension): 4 vulnerabilities - [Wikimedia Foundation CheckUser](https://junglewise.ai/threats/technologies/checkuser): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wikimedia Foundation Mediawiki vulnerabilities", https://junglewise.ai/threats/technologies/mediawiki, 9 November 2026.