CVE-2026-22711

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22711", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-01-08T23:23:42.385Z", "datePublished": "2026-04-07T18:39:37.410Z", "dateUpdated": "2026-04-08T22:02:16.476Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-04-08T22:02:16.476Z"}, "title": "Stored XSS through system messages in WikiLove", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-87", "description": "CWE-87 Improper neutralization of alternate XSS syntax", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - Wikilove Extension", "versions": [{"status": "unaffected", "version": "1.43"}, {"status": "unaffected", "version": "1.44"}, {"status": "unaffected", "version": "1.45"}, {"status": "affected", "version": "0", "lessThan": "1.43", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).<p>The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.<br></p>"}]}], "references": [{"url": "https://phabricator.wikimedia.org/T416502"}, {"url": "https://gerrit.wikimedia.org/r/q/Iab86209478a044504f5a6aea0d8c3d14f21c48b3"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "SomeRandomDeveloper", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22711", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T20:34:51.173753Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T20:42:44.089Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22711", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T20:34:51.173753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T20:40:36.379Z"}}], "cna": {"title": "Stored XSS through system messages in WikiLove", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "SomeRandomDeveloper"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - Wikilove Extension", "versions": [{"status": "unaffected", "version": "1.43"}, {"status": "unaffected", "version": "1.44"}, {"status": "unaffected", "version": "1.45"}, {"status": "affected", "version": "0", "lessThan": "1.43", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://phabricator.wikimedia.org/T416502"}, {"url": "https://gerrit.wikimedia.org/r/q/Iab86209478a044504f5a6aea0d8c3d14f21c48b3"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).<p>The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.<br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-87", "description": "CWE-87 Improper neutralization of alternate XSS syntax"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-04-08T22:02:16.476Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22711", "state": "PUBLISHED", "dateUpdated": "2026-04-08T22:02:16.476Z", "dateReserved": "2026-01-08T23:23:42.385Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-04-07T18:39:37.410Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Mediawiki - Wikilove Extension", "vendor": "The Wikimedia Foundation", "versions": [{"status": "unaffected", "version": "1.43"}, {"status": "unaffected", "version": "1.44"}, {"status": "unaffected", "version": "1.45"}, {"lessThan": "1.43", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45."}, {"lang": "es", "value": "Vulnerabilidad por neutralizaci\u00f3n incorrecta de sintaxis XSS alternativa en la extensi\u00f3n Mediawiki - Wikilove de The Wikimedia Foundation permite cross-site scripting (XSS). Este problema afecta a la extensi\u00f3n Mediawiki - Wikilove: 1.43.7, 1.44.4, 1.45.2."}], "id": "CVE-2026-22711", "lastModified": "2026-07-21T19:10:00.107", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22711", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T20:34:51.173753Z", "version": "2.0.3"}}]}, "published": "2026-04-07T19:16:43.980", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "url": "https://gerrit.wikimedia.org/r/q/Iab86209478a044504f5a6aea0d8c3d14f21c48b3"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "url": "https://phabricator.wikimedia.org/T416502"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-87"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.43.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.44.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.45.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Mediawiki - Wikilove Extension", "source": "cna", "vendor": "The Wikimedia Foundation"}, "product": "mediawiki-wikilove_extension", "vendor": "wikimedia"}], "analysis": {"en": {"generated_at": "2026-04-08T23:27:58.807372+00:00", "value": {"mitigation_remediation": ["Upgrade MediaWiki to version 1.43 or newer, ensuring the latest WikiLove extension is in use.", "If upgrading is not immediately possible, replace the WikiLove extension with the patched commit from the master branch, or apply the patch that neutralizes alternate XSS syntax.", "Verify that the replacement or upgraded installation processes the stored messages correctly before allowing them to be displayed to end users."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The flaw affects installations of the Wikimedia Foundation's MediaWiki that use the WikiLove extension before version 1.43 or before the patch was applied to the master branch. The issue has been fixed in the release branches for MediaWiki 1.43, 1.44, and 1.45, so systems running these or later versions are no longer vulnerable.", "description_and_impact": "A vulnerability in the WikiLove extension of MediaWiki allows an attacker to inject malicious script that is stored and later displayed to users. The improper neutralization of alternate XSS syntax means that crafted input can persist and be executed in the context of a victim\u2019s browser, potentially enabling session hijacking, defacement, or phishing. This weakness corresponds to CWE\u201187 and supports a cross\u2011site scripting attack with a high exploit potential.", "risk_and_exploitability": "The CVSS v3.1 score of 6.9 indicates a medium severity. The EPSS score of less than 1% suggests a low probability of seeing an exploit in the wild at this time, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw is a stored XSS, an attacker only needs to be able to add a system message or otherwise contribute content to the extension; no additional prerequisites are noted. The lack of a public exploit does not negate the risk: any authenticated or even publicly available message could be used, so the vulnerability can be leveraged remotely by users with write access to WikiLove messages."}}}}, "created": "2026-04-08T19:46:36.822920+00:00", "updated": "2026-04-09T08:28:43.139668+00:00", "vendors": ["wikimedia", "wikimedia$PRODUCT$mediawiki-wikilove_extension"]}