| CVE-2026-103585
| MMMediaWiki MediaSearch extension The Wikimedia Foundation | 1.2 | | Sep 30 | attacker-controlled javascript license URL via XSS |
| CVE-2026-103584
| MCMediaWiki CommonsMetadata extension The Wikimedia Foundation | 1.1 | | Sep 30 | attacker-controlled javascript license URL via XSS |
| CVE-2026-103440
| MPMediaWiki PageTriage extension The Wikimedia Foundation | 1.2 | | Sep 30 | pagetriagelist discloses suppressed reviewer usernames |
| CVE-2026-103439
| MWMediaWiki Wikbase extension The Wikimedia Foundation | 0.3 | | Sep 30 | Various rawParams() and escaped() updates to prevent XSS in Wikibase extension |
| CVE-2026-103438
| MWMediaWiki Wikistories extension The Wikimedia Foundation | 0.3 | | Sep 30 | Various rawParams() and escaped() updates to prevent XSS in Wikistories extension |
| CVE-2026-103437
| MRMediaWiki ReadingLists extension The Wikimedia Foundation | 1.1 | | Sep 30 | ReadingLists imported metadata permits JavaScript URL XSS |
| CVE-2026-103446
| MWMediaWiki WikiLambda extension The Wikimedia Foundation | 7.4 | | Sep 30 | WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments |
| CVE-2026-103445
| MPMediaWiki Page_Forms extension The Wikimedia Foundation | 1.2 | | Sep 30 | Stored XSS through PageForms #autoedit redirect links |
| CVE-2026-103444
| MWMediaWiki WikiForum extension The Wikimedia Foundation | 1.1 | | Sep 30 | Stored XSS through system messages in WikiForum |
| CVE-2026-103443
| MCMediaWiki Collection (Book) extension The Wikimedia Foundation | 1.1 | | Sep 30 | API permits session-seeded javascript URL XSS |
| CVE-2026-103442
| MCMediaWiki CentralAuth extension The Wikimedia Foundation | 7.2 | | Sep 30 | MergeAccount PHP object injection via session-key substitution |
| CVE-2026-103441
| MWMediaWiki Wikibase extension The Wikimedia Foundation | 7.2 | | Sep 30 | Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing |
| CVE-2026-103051
| MCMediawiki - CentralNotice extension The Wikimedia Foundation | 6.1 | | Sep 29 | Stored i18n XSSs in CentralNotice |
| CVE-2026-103050
| MMMediawiki - MassMessage extension The Wikimedia Foundation | 6.1 | | Sep 29 | Stored i18n XSS in MassMessage |
| CVE-2026-103049
| MCMediawiki - Cargo extension The Wikimedia Foundation | 6.1 | | Sep 29 | XSS in Cargo's Special:CargoQuery page due to unsanitized table headers |
| CVE-2026-103048
| MCMediawiki - Collection extension The Wikimedia Foundation | 6.1 | | Sep 29 | Open Redirect in Special:Book |
| CVE-2026-103047
| MCMediawiki - CentralAuth extension The Wikimedia Foundation | 6.1 | | Sep 29 | XSS through i18n message in CentralAuth |
| CVE-2026-103045
| MRMediawiki - Refreshed skin The Wikimedia Foundation | 6.1 | | Sep 29 | XSS in Refreshed skin |
| CVE-2026-103044
| MEMediawiki - EasyTimeline extension The Wikimedia Foundation | 9.8 | | Sep 29 | EasyTimeline should not serve image maps as application/xml |
| CVE-2026-103046
| MWMediawiki - WikiLambda Extension The Wikimedia Foundation | 6.1 | | Sep 29 | WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML |
| CVE-2026-96879
| MFMediawiki - FlaggedRevs extension The Wikimedia Foundation | 6.9 | | Sep 25 | "Checked by" label in page history should not be shown if the underlying review log entry is suppressed" |
| CVE-2026-96878
| MCMediawiki - Cargo extension The Wikimedia Foundation | 6.9 | | Sep 25 | Cargo Exhibit field alias allows stored XSS |
| CVE-2026-96877
| MCMediawiki - Cargo extension The Wikimedia Foundation | 6.9 | | Sep 25 | Reflected XSS through Cargo Drilldown full-text search |
| CVE-2026-96876
| MCMediawiki - Cargo extension The Wikimedia Foundation | 6.9 | | Sep 25 | Anonymous reflected XSS in CargoExport invalid-alias errors |
| CVE-2026-96875
| MCMediawiki - Cargo extension The Wikimedia Foundation | 6.9 | | Sep 25 | Reflected XSS in Cargo Drilldown hierarchy filters |
| CVE-2026-100237
| MTMediawiki - Thanks Extension The Wikimedia Foundation | 6.1 | | Sep 25 | Stored i18n XSS in the Flow integration of Thanks |
| CVE-2026-96874
| MCMediawiki - Cargo extension The Wikimedia Foundation | 2.3 | | Sep 25 | Stored XSS in Cargo Drilldown tab names |
| CVE-2026-96873
| MCMediawiki - CirrusSearch Extension The Wikimedia Foundation | 5.5 | | Sep 24 | Reflected XSS in CirrusSearch debug explain output |
| CVE-2026-96872
| MWMediawiki - WikiLambda Extension The Wikimedia Foundation | 2.9 | | Sep 23 | WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions |
| CVE-2026-14363
| MCMediawiki - Cargo Extension The Wikimedia Foundation | 9.8 | | Jul 1 | Cargo Extension: SQLi in Special:Drilldown |
| CVE-2026-14358
| MCMediawiki - Charts Extension The Wikimedia Foundation | 6.1 | | Jul 1 | Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title |
| CVE-2026-58517
| MWMediawiki - WikiLambda Extension The Wikimedia Foundation | 4.3 | | Jul 1 | Blocked users can create and edit WikiLambda objects |
| CVE-2026-58521
| MCMediawiki - Cargo Extension The Wikimedia Foundation | 9.8 | | Jul 1 | SQLi in Cargo extension via year range filter |
| CVE-2026-58520
| MUMediawiki - UrlShortener Extension The Wikimedia Foundation | 6.1 | | Jul 1 | UrlShortener defaults to ineffective validation open to third-party redirects |
| CVE-2026-58519
| MCMediawiki - Cargo Extension The Wikimedia Foundation | 5.4 | | Jul 1 | Stored XSS through Cargo's map format |
| CVE-2026-58518
| MRMediawiki - RedirectManager Extension The Wikimedia Foundation | 6.3 | | Jul 1 | Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery |
| CVE-2026-39936
| MSMediawiki - Score Extension The Wikimedia Foundation | 6.9 | | Apr 7 | Stored XSS in Score due to usage of non-reserved data attributes |
| CVE-2026-39935
| MCMediawiki - CampaignEvents Extension The Wikimedia Foundation | 6.9 | | Apr 7 | XSS-via-i18n in localised wiki names |
| CVE-2026-39934
| MGMediawiki - GrowthExperiments Extension The Wikimedia Foundation | 6.9 | | Apr 7 | Growth Experiments ReassignMenteesJob runs as an infinite loop |
| CVE-2026-39933
| MGMediawiki - GlobalWatchlist Extension The Wikimedia Foundation | 6.9 | | Apr 7 | Multiple XSS vulnerabilities in GlobalWatchlist |
| CVE-2026-39937
| MCMediawiki - CentralAuth Extension The Wikimedia Foundation | 8.8 | | Apr 7 | Global vanishing does not completely remove user email |
| CVE-2026-22711
| MWMediawiki - Wikilove Extension The Wikimedia Foundation | 6.9 | | Apr 7 | Stored XSS through system messages in WikiLove |
