CVE-2026-22710

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22710", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-01-08T23:23:42.385Z", "datePublished": "2026-01-08T23:48:51.645Z", "dateUpdated": "2026-01-09T19:16:54.193Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mediawiki - Wikibase Extension", "vendor": "The Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "credits": [{"lang": "en", "type": "finder", "value": "SomeRandomDeveloper"}, {"lang": "en", "type": "remediation developer", "value": "SomeRandomDeveloper"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).<p>This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 2.3, "baseSeverity": "LOW", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-08T23:48:51.645Z"}, "references": [{"url": "https://phabricator.wikimedia.org/T409737"}, {"url": "https://gerrit.wikimedia.org/r/q/I39d0074b2ad022b6efe6ab3dd8c8ec0f86c6c466"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored XSS through autocomment system messages in Wikibase", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"references": [{"url": "https://phabricator.wikimedia.org/T409737", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T19:16:39.789371Z", "id": "CVE-2026-22710", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T19:16:54.193Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22710", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T19:16:39.789371Z"}}}], "references": [{"url": "https://phabricator.wikimedia.org/T409737", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T19:16:51.483Z"}}], "cna": {"title": "Stored XSS through autocomment system messages in Wikibase", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "SomeRandomDeveloper"}, {"lang": "en", "type": "remediation developer", "value": "SomeRandomDeveloper"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - Wikibase Extension", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T409737"}, {"url": "https://gerrit.wikimedia.org/r/q/I39d0074b2ad022b6efe6ab3dd8c8ec0f86c6c466"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).<p>This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-08T23:48:51.645Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22710", "state": "PUBLISHED", "dateUpdated": "2026-01-09T19:16:54.193Z", "dateReserved": "2026-01-08T23:23:42.385Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-01-08T23:48:51.645Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mediawiki - Wikibase Extension", "vendor": "The Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wikimedia:wikibase:1.39:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "21EB82EB-C22D-4A16-B3A1-CB6F0F2D2661", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:wikibase:1.43:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "302E2D70-A49A-4619-90AF-0F25F21116FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:wikibase:1.44:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "8E22B8DD-FA07-4B38-8583-A6979DE2A904", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:wikibase:1.45:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "2D5635D0-2A42-4145-BA77-1C0D26D37FBF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39."}, {"lang": "es", "value": "Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web (XSS o 'cross-site scripting') vulnerabilidad en la extensi\u00f3n Mediawiki - Wikibase de The Wikimedia Foundation permite cross-site scripting (XSS). Este problema afecta a la extensi\u00f3n Mediawiki - Wikibase: 1.45, 1.44, 1.43, 1.39."}], "id": "CVE-2026-22710", "lastModified": "2026-06-17T10:20:16.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22710", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T19:16:39.789371Z", "version": "2.0.3"}}]}, "published": "2026-01-09T00:15:45.693", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/q/I39d0074b2ad022b6efe6ab3dd8c8ec0f86c6c466"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking"], "url": "https://phabricator.wikimedia.org/T409737"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking"], "url": "https://phabricator.wikimedia.org/T409737"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:30:04.511373+00:00", "value": {"mitigation_remediation": ["Upgrade the Mediawiki Wikibase Extension to the latest version that fixes the stored XSS flaw.", "If an upgrade is not immediately possible, configure the extension or server to automatically sanitize or remove untrusted content from autocomment system messages before they are rendered.", "Continuously monitor user activity for signs of script injection or abnormal comment behavior and apply additional input validation if the feature remains enabled."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The Wikimedia Foundation\u2019s Mediawiki Wikibase Extension is affected. Versions 1.39, 1.43, 1.44, and 1.45 contain the flaw. Users running any of these releases are at risk if autocomment messages are displayed to community members.", "description_and_impact": "This vulnerability allows stored cross\u2011site scripting in autocomment system messages within the Wikibase extension. An attacker can inject malicious JavaScript that will run in the browsers of any user who views an autocomment, potentially enabling phishing, cookie theft, or defacement. The weakness is described as an improper neutralization of input during web page generation and is identified by CWE\u201179.", "risk_and_exploitability": "The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1\u202f% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the attacker to deliver a payload that will be stored and later displayed as an autocomment. No public exploits have been reported, but the low scoring reflects limited impact if a directly affected user is compromised. Given the low probability, immediate remediation is still recommended to prevent potential phishing or defacement attacks."}}}}, "created": "2026-01-09T13:24:06.984181+00:00", "updated": "2026-04-18T07:30:36.037713+00:00", "vendors": ["mediawiki", "mediawiki$PRODUCT$mediawiki", "wikimedia", "wikimedia$PRODUCT$mediawiki-wikibase_extension"]}