PageForms - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pageforms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 30 Sep 2026 19:34:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in PageForms Extensionhttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-103445/Wed, 30 Sep 2026 19:34:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-103445/A stored XSS vulnerability in the PageForms extension allows attackers with page-edit permissions to inject malicious javascript: URIs via the redirect parameter.CVE-2026-103445 is a stored Cross-Site Scripting (XSS) vulnerability affecting the PageForms extension. The vulnerability exists because the extension fails to properly validate the URI scheme when processing the 'redirect' parameter used in the 'href' attribute of generated links. An attacker with ordinary page-edit permissions can craft a malicious wikitext entry containing a 'javascript:' URI. When a legitimate user or administrator interacts with the resulting link on the wiki page, the arbitrary JavaScript executes in the context of the victim's browser session. This vulnerability was disclosed and verified with a public proof-of-concept on September 30, 2026. Given the low CVSS severity (2.1), this issue primarily poses a risk in environments where users with edit permissions are not fully trusted or where social engineering campaigns could leverage the link to hijack administrative sessions.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of a victim's browser session. While the severity is low, potential impacts include session hijacking, unauthorized actions performed on behalf of the victim, or the theft of sensitive session cookies if anti-XSS headers are not strictly enforced. The vulnerability affects users of the PageForms extension across any platform running the affected version.

Recommendation

Prioritize patching the PageForms extension by applying the fix available in the Wikimedia Gerrit repository. Given the nature of XSS, detection engineering teams should review web access logs and Content Security Policy (CSP) configurations to ensure unauthorized scripts are blocked from execution.

  • Apply the security patch for CVE-2026-103445 provided at the referenced Gerrit URL.
  • Audit wiki page content for suspicious 'href' attributes containing 'javascript:' URI schemes.
  • Implement or strengthen Content Security Policy (CSP) headers to restrict inline script execution and block unauthorized domains.
]]>lowadvisoryweb-vulnerabilityxsspageforms