CVE-2026-103045 - Vulnerability Details - OpenCVE

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
The Wikimedia Foundation	Mediawiki - Refreshed Skin

No data.

No data.

References

Link	Providers
https://gerrit.wikimedia.org/r/c/mediawiki/skins/Refreshed/+/1309277
https://phabricator.wikimedia.org/T268377

History

Wed, 30 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 30 Sep 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		The Wikimedia Foundation The Wikimedia Foundation mediawiki - Refreshed Skin
Vendors & Products		The Wikimedia Foundation The Wikimedia Foundation mediawiki - Refreshed Skin

Tue, 29 Sep 2026 23:00:00 +0000

Type	Values Removed	Values Added
Description		Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
Title		XSS in Refreshed skin
Weaknesses		CWE-79
References		https://gerrit.wikimedia.org/r/c/mediawiki/skins/Refreshed/+/1309277 https://phabricator.wikimedia.org/T268377

MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published: 2026-09-29T22:51:04.067Z

Updated: 2026-09-30T20:24:48.261Z

Reserved: 2026-09-29T22:29:32.001Z

Link: CVE-2026-103045

Vulnrichment

Updated: 2026-09-30T20:24:39.895Z

NVD

Status : Awaiting Analysis

Published: 2026-09-29T23:17:22.327

Modified: 2026-09-30T21:17:07.650

Link: CVE-2026-103045

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103045", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-09-29T22:29:32.001Z", "datePublished": "2026-09-29T22:51:04.067Z", "dateUpdated": "2026-09-30T20:24:48.261Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-09-29T22:51:04.067Z"}, "title": "XSS in Refreshed skin", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - Refreshed skin", "repo": "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/skins/Refreshed/+/refs/heads/master", "versions": [{"status": "affected", "version": "0", "lessThan": "1.46.1, 1.45.5, 1.43.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.\n\nThis issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.<p>This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.</p>"}]}], "references": [{"url": "https://phabricator.wikimedia.org/T268377", "tags": ["issue-tracking"]}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/skins/Refreshed/+/1309277", "tags": ["mitigation"]}], "credits": [{"lang": "en", "value": "Daimona", "type": "finder"}, {"lang": "en", "value": "SomeRandomDeveloper", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T20:23:53.802862Z", "id": "CVE-2026-103045", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:24:48.261Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-103045", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T20:23:53.802862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:24:39.895Z"}}], "cna": {"title": "XSS in Refreshed skin", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Daimona"}, {"lang": "en", "type": "remediation developer", "value": "SomeRandomDeveloper"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"repo": "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/skins/Refreshed/+/refs/heads/master", "vendor": "The Wikimedia Foundation", "product": "Mediawiki - Refreshed skin", "versions": [{"status": "affected", "version": "0", "lessThan": "1.46.1, 1.45.5, 1.43.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T268377", "tags": ["issue-tracking"]}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/skins/Refreshed/+/1309277", "tags": ["mitigation"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.\n\nThis issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.<p>This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-09-29T22:51:04.067Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103045", "state": "PUBLISHED", "dateUpdated": "2026-09-30T20:24:48.261Z", "dateReserved": "2026-09-29T22:29:32.001Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-09-29T22:51:04.067Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}