CVE-2026-100238: Wikimedia Foundation Mediawiki - Flow Extension

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Affected products

• Wikimedia Foundation Mediawiki - Flow Extension

Published 2026-09-29. Last modified 2026-09-30.