According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.9, 1.44.x prior to 1.44.6 or 1.45.x prior to 1.45.4. It is, therefore, affected by a number of vulnerabilities as follows.

- LogItem insecure deserialization enabling an arbitrary file write and remote code execution (RCE) via crafted XML during log imports. (CVE-2026-58025)

- ApiQueryUsers leaks the status of private user conditions. (CVE-2026-58036)

- User JavaScript is allowed in pretty-print API responses. (CVE-2026-58028)

- Rev-deleted usernames are exposed in author queries. (CVE-2026-58033)

- API error messages with formatversion=1 are treated as text. (CVE-2026-58032)

- Transcluded titles are not correctly restricted to includable titles. (CVE-2026-58026)

- Insufficient restriction of user lookups in ApiUserrights across interwikis. (CVE-2026-58024)

- Insufficient editmyprivateinfo validation when editing private info. (CVE-2026-58029)

- The LogFormatter raw parameter outputs raw HTML. (CVE-2026-58037)

- AbuseFilter exposes hit counts for protected filters in the API. (CVE-2026-58027)

- SyntaxHighlight_GeSHi does not escape linelinks before Pygments processing. (CVE-2026-58030)

- EasyTimeline script injection via TextData. (CVE-2026-8857)

- Timeline generated SVG stored XSS. (CVE-2026-58038)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation     MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php,     includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php,     includes/User/UserGroupManager.Php. (CVE-2026-58036)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
115322	MediaWiki < 1.43.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium
115324	MediaWiki 1.45.x < 1.45.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium
115323	MediaWiki 1.44.x < 1.44.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	medium
324688	Linux Distros Unpatched Vulnerability : CVE-2026-58036	Nessus	Misc.	7/2/2026	9/4/2026	low

Detections

Analytics

Plugins Search

medium

medium

medium

low