Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39.
References
| Link | Resource |
|---|---|
| https://gerrit.wikimedia.org/r/q/I7c028db5ed81843aacd596b0ee4dc2980f5b6e3c | Patch |
| https://phabricator.wikimedia.org/T409423 | Exploit Issue Tracking |
Configurations
Configuration 1 (hide)
|
History
23 Feb 2026, 18:40
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wikisource:proofread_page:1.43:*:*:*:*:mediawiki:*:* cpe:2.3:a:wikisource:proofread_page:1.45:*:*:*:*:mediawiki:*:* cpe:2.3:a:wikisource:proofread_page:1.39:*:*:*:*:mediawiki:*:* cpe:2.3:a:wikisource:proofread_page:1.44:*:*:*:*:mediawiki:*:* |
|
| References | () https://gerrit.wikimedia.org/r/q/I7c028db5ed81843aacd596b0ee4dc2980f5b6e3c - Patch | |
| References | () https://phabricator.wikimedia.org/T409423 - Exploit, Issue Tracking | |
| First Time |
Wikisource
Wikisource proofread Page |
07 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
07 Jan 2026, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-07 19:15
Updated : 2026-02-23 18:40
NVD link : CVE-2026-0670
Mitre link : CVE-2026-0670
CVE.ORG link : CVE-2026-0670
JSON object : View
Products Affected
wikisource
- proofread_page
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')