According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.9, 1.44.x prior to 1.44.6 or 1.45.x prior to 1.45.4. It is, therefore, affected by a number of vulnerabilities as follows.

- LogItem insecure deserialization enabling an arbitrary file write and remote code execution (RCE) via crafted XML during log imports. (CVE-2026-58025)

- ApiQueryUsers leaks the status of private user conditions. (CVE-2026-58036)

- User JavaScript is allowed in pretty-print API responses. (CVE-2026-58028)

- Rev-deleted usernames are exposed in author queries. (CVE-2026-58033)

- API error messages with formatversion=1 are treated as text. (CVE-2026-58032)

- Transcluded titles are not correctly restricted to includable titles. (CVE-2026-58026)

- Insufficient restriction of user lookups in ApiUserrights across interwikis. (CVE-2026-58024)

- Insufficient editmyprivateinfo validation when editing private info. (CVE-2026-58029)

- The LogFormatter raw parameter outputs raw HTML. (CVE-2026-58037)

- AbuseFilter exposes hit counts for protected filters in the API. (CVE-2026-58027)

- SyntaxHighlight_GeSHi does not escape linelinks before Pygments processing. (CVE-2026-58030)

- EasyTimeline script injection via TextData. (CVE-2026-8857)

- Timeline generated SVG stored XSS. (CVE-2026-58038)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115322	MediaWiki < 1.43.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium
115324	MediaWiki 1.45.x < 1.45.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium
115323	MediaWiki 1.44.x < 1.44.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium