CVE-2026-100380 Wikimedia Foundation CVE debrief

Who should care

Defenders responsible for Mediawiki - Wikibase Extension installations, especially those using versions before 1.46.1, 1.45.5, and 1.43.10, should assess exposure and prioritize patching or applying workarounds.

Why it matters

CVE-2026-100380 is a Cross-Site Scripting (XSS) vulnerability in Mediawiki - Wikibase Extension that requires attention from defenders to verify exposure and apply patches or workarounds.

• Potential for Cross-Site Scripting (XSS) attacks
• Need for version updates or workarounds to mitigate vulnerability
• Importance of inventory checks for affected Mediawiki - Wikibase Extension installations
• Potential impact on web application security if left unpatched

Technical summary

The CVE record describes an XSS vulnerability in Mediawiki - Wikibase Extension due to improper neutralization of input during web page generation. The vulnerability affects versions before 1.46.1, 1.45.5, and 1.43.10. It has a CVSS score of 5.3 and a severity of MEDIUM. The vulnerability requires attention from defenders to verify exposure and apply patches or workarounds. The affected product deployments should be reviewed to ensure version compliance and to plan vendor-supported updates or mitigations through normal change control.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or workarounds for Mediawiki - Wikibase Extension, especially for versions before 1.46.1, 1.45.5, and 1.43.10.

Recommended defensive actions

• Verify and apply patches or workarounds for Mediawiki - Wikibase Extension versions before 1.46.1, 1.45.5, and 1.43.10
• Review and update inventory of Mediawiki - Wikibase Extension installations to ensure version compliance
• Monitor for potential XSS attacks targeting Mediawiki - Wikibase Extension
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the XSS vulnerability in Mediawiki - Wikibase Extension. However, the corpus does not establish specific exploitation instances or remediation beyond version updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.