CVE-2026-103443

UNKNOWN 0.0

API permits session-seeded javascript URL XSS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection (Book) extension: 1.46, 1.45, and 1.43.

CWE	CWE-80
Vendor	the wikimedia foundation
Product	mediawiki collection (book) extension
Published	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for the wikimedia foundation mediawiki collection (book) extension

Be the first to know when new unknown vulnerabilities affecting the wikimedia foundation mediawiki collection (book) extension are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

The Wikimedia Foundation / MediaWiki Collection (Book) extension

1.46 1.45 1.43

References

NVD ↗ CVE.org ↗ EPSS Data ↗

phabricator.wikimedia.org: https://phabricator.wikimedia.org/T435822 gerrit.wikimedia.org: https://gerrit.wikimedia.org/r/q/I51d973d4ace99fb6e584296f296efb0ff50339ce

Credits

🔍 Marco Paciaroni (BomboBombone)