CVE-2026-103044
published 2026-09-29CVE-2026-103044: XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.44%
35.7th percentile
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.
This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| the_wikimedia_foundation | mediawiki_easytimeline_extension | < 1.46.1, 1.45.5, 1.43.10 | 1.46.1, 1.45.5, 1.43.10 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Wikimedia MediaWiki up to 1.46.0/1.45.4/1.43.9 EasyTimeline Extension xml injection
vuldb·2026-09-30
CVE-2026-103044 [CRITICAL] Wikimedia MediaWiki up to 1.46.0/1.45.4/1.43.9 EasyTimeline Extension xml injection
A vulnerability was found in Wikimedia MediaWiki up to 1.46.0/1.45.4/1.43.9. It has been declared as critical. This impacts an unknown function of the component EasyTimeline Extension. The manipulation results in xml injection.
This vulnerability is identified as CVE-2026-103044. The attack can be executed remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.
ghsa_unreviewed·2026-09-30
CVE-2026-103044 CWE-91 XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.
This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
No detection rules found.
No public exploits indexed.
2026-09-29
Published