Vulnerability · Published Sep 30, 2026 · Assigned by wikimedia-foundation

CVE-2026-103437ReadingLists imported metadata permits JavaScript URL XSS

Low 1.1

In plain English

A low-severity security flaw in MediaWiki ReadingLists extension from The Wikimedia Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)1.1Low

Exploit odds (30 days)0.3%top 75.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

Affected products (as reported)

Vendor	Product	Versions
The Wikimedia Foundation	MediaWiki ReadingLists extension	1.461.45

Weakness: CWE-80 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

In plain English

Official description

Affected products (as reported)

References