CVE-2026-22711 The Wikimedia Foundation CVE debrief

Who should care

Users of The Wikimedia Foundation Mediawiki - Wikilove Extension, particularly those using versions prior to 1.43, should be aware of this vulnerability and take steps to remediate it. This includes applying the patches provided by the vendor for MediaWiki versions 1.43, 1.44, and 1.45, and reviewing and updating the Wikilove Extension to ensure it is using the latest version.

Technical summary

The Wikimedia Foundation Mediawiki - Wikilove Extension is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of alternate XSS syntax. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45. The vulnerability allows attackers to inject malicious scripts into the application, potentially leading to unauthorized actions on behalf of the user. The remediation involves updating the Wikilove Extension to ensure it is using the latest version.

Defensive priority

Medium priority given the CVSS score of 6.9 and the availability of patches.

Recommended defensive actions

• Apply the patches provided by the vendor for MediaWiki versions 1.43, 1.44, and 1.45.
• Review and update the Wikilove Extension to ensure it is using the latest version.
• Monitor for any suspicious activity related to the Wikilove Extension.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and testing may be necessary to fully understand the impact of this vulnerability. The Wikimedia Foundation Mediawiki - Wikilove Extension is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of alternate XSS syntax. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45. However, the specifics of the vulnerability, such as the versions prior to 1.43 that might be affected or detailed technical analysis, are not provided in the CVE record or NVD entry.

Official resources