According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.7, 1.44.x prior to 1.44.4 or 1.45.x prior to 1.45.2. It is, therefore, affected by a number of vulnerabilities as follows.

- Block UI elements in the 'tools' sidebar reveal the presence of an autoblocked IP. (CVE-2026-34092)

- RecentChanges entries expose suppressed content via generated log page HTML. (CVE-2026-34088)

- User localization is leaked by AbuseFilter + EventStream. (CVE-2026-34091)

- Suggested investigations do not handle suppressed usernames. (CVE-2026-34090)

- The Users API leaks whether privileged users have their user groups disabled for lack of 2FA. (CVE-2026-34087)

- Special:UserRights allows viewing user rights from a private wiki. (CVE-2026-34093)

- AbuseFilter misuses ::userCanBitfield, exposing access-controlled information. (CVE-2026-34086)

- The customized help link for the page protection indicator is relative to the subpage name. (CVE-2026-34094)

- A memory leak in Scribunto causes runJobs.php to run out of memory. (CVE-2026-34089)

- action=raw with a Special:Mypage subpage responds with text/html on a javascript request. (CVE-2026-34095)

- The Notifications (Echo) API can be used by any OAuth tool. (CVE-2026-5266)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115327	MediaWiki 1.45.x < 1.45.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium
115325	MediaWiki < 1.43.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium
115326	MediaWiki 1.44.x < 1.44.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium