CVE-2023-45359: Mediawiki Vector Skin

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup.

Affected products

• Mediawiki Vector Skin: before 1.39.5 (fixed in 1.39.5); from 1.40.0, before 1.40.1 (fixed in 1.40.1)

Published 2024-10-09. Last modified 2026-06-17.