CVE-2026-58037
published 2026-07-01CVE-2026-58037: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.27%
18.9th percentile
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php.
This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | >= 1.43.0 < 1.43.9 | 1.43.9 |
| mediawiki | mediawiki | >= 1.44.0 < 1.44.6 | 1.44.6 |
| mediawiki | mediawiki | >= 1.45.0 < 1.45.4 | 1.45.4 |
| wikimedia_foundation | mediawiki | >= * < 1.46.0, 1.45.4, 1.44.6, 1.43.9 | 1.46.0, 1.45.4, 1.44.6, 1.43.9 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.00.0NONECVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Wikimedia MediaWiki up to 1.45.x/1.45.3/1.44.5/1.43.8 Language.Php cross site scripting
vuldb·2026-07-01
CVE-2026-58037 [NONE] Wikimedia MediaWiki up to 1.45.x/1.45.3/1.44.5/1.43.8 Language.Php cross site scripting
A vulnerability categorized as problematic has been discovered in Wikimedia MediaWiki up to 1.45.x/1.45.3/1.44.5/1.43.8. This affects an unknown function of the file includes/Language/Language.Php. Such manipulation leads to cross site scripting.
This vulnerability is traded as CVE-2026-58037. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
ghsa_unreviewed·2026-07-01
CVE-2026-58037 [LOW] CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php.
This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-01
Published