MediaWiki

Multiple vulnerabilities in MediaWiki allow remote, unauthenticated attackers to conduct Cross-Site Scripting (XSS) attacks by exploiting insufficient input validation within the application.

A high-severity stored cross-site scripting (XSS) vulnerability, CVE-2026-52854, exists in the MediaWiki Maps extension (versions prior to 12.1.3), allowing any authenticated user with edit permissions to inject malicious JavaScript into the `overlays` parameter of the `display_map` parser function, leading to arbitrary client-side code execution in a victim's browser.

A remote, authenticated attacker can exploit multiple vulnerabilities in MediaWiki to execute arbitrary code, disclose information, perform a cross-site scripting attack, or cause a denial of service condition.