CVE-2026-103584

UNKNOWN 0.0

attacker-controlled javascript license URL via XSS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.

CWE	CWE-80
Vendor	the wikimedia foundation
Product	mediawiki commonsmetadata extension
Published	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for the wikimedia foundation mediawiki commonsmetadata extension

Be the first to know when new unknown vulnerabilities affecting the wikimedia foundation mediawiki commonsmetadata extension are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

The Wikimedia Foundation / MediaWiki CommonsMetadata extension

1.46 1.45 1.43

References

NVD ↗ CVE.org ↗ EPSS Data ↗

phabricator.wikimedia.org: https://phabricator.wikimedia.org/T435999 gerrit.wikimedia.org: https://gerrit.wikimedia.org/r/q/I66c102cae36a9d499c95c37db7458371c7c87258

Credits

🔍 Marco Paciaroni (BomboBombone)