Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.9, 1.44.x prior to 1.44.6 or 1.45.x prior to 1.45.4. It is, therefore, affected by a number of vulnerabilities as follows.

- LogItem insecure deserialization enabling an arbitrary file write and remote code execution (RCE) via crafted XML during log imports. (CVE-2026-58025)

- ApiQueryUsers leaks the status of private user conditions. (CVE-2026-58036)

- User JavaScript is allowed in pretty-print API responses. (CVE-2026-58028)

- Rev-deleted usernames are exposed in author queries. (CVE-2026-58033)

- API error messages with formatversion=1 are treated as text. (CVE-2026-58032)

- Transcluded titles are not correctly restricted to includable titles. (CVE-2026-58026)

- Insufficient restriction of user lookups in ApiUserrights across interwikis. (CVE-2026-58024)

- Insufficient editmyprivateinfo validation when editing private info. (CVE-2026-58029)

- The LogFormatter raw parameter outputs raw HTML. (CVE-2026-58037)

- AbuseFilter exposes hit counts for protected filters in the API. (CVE-2026-58027)

- SyntaxHighlight_GeSHi does not escape linelinks before Pygments processing. (CVE-2026-58030)

- EasyTimeline script injection via TextData. (CVE-2026-8857)

- Timeline generated SVG stored XSS. (CVE-2026-58038)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115324	MediaWiki 1.45.x < 1.45.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115323	MediaWiki 1.44.x < 1.44.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115322	MediaWiki < 1.43.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2026-58038

info

Tenable Plugins

medium

medium

medium