CVE-2026-22711: MediaWiki Wikilove Extension XSS Flaw

CVE-2026-22711 Overview

CVE-2026-22711 is a Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation MediaWiki WikiLove extension. The flaw stems from improper neutralization of alternate XSS syntax [CWE-87], allowing attackers to inject script payloads that bypass standard sanitization filters. The vulnerability affects MediaWiki deployments running the WikiLove extension across versions prior to the patched releases. Wikimedia remediated the issue on the master branch and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in the browsers of authenticated wiki users, leading to session hijacking, content manipulation, and credential theft.

Affected Products

MediaWiki WikiLove Extension on versions prior to 1.43 patched release
MediaWiki WikiLove Extension on versions prior to 1.44 patched release
MediaWiki WikiLove Extension on versions prior to 1.45 patched release

Discovery Timeline

2026-04-07 - CVE-2026-22711 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-22711

Vulnerability Analysis

The WikiLove extension provides a user interface element for sending appreciation messages between MediaWiki users. The extension processes user-supplied content that is rendered in the browser context of recipients and other viewers. The sanitization layer fails to neutralize alternate XSS syntax variants, allowing crafted input to bypass filters that block conventional script payloads.

The CWE-87 classification identifies this as an improper neutralization of alternate XSS syntax. Attackers exploit encoding variations, malformed tag structures, or alternative attribute syntaxes that the sanitizer does not recognize as dangerous. The malicious markup survives the filter and executes when rendered.

Root Cause

The vulnerability stems from incomplete coverage of XSS vectors in the WikiLove input sanitization routines. The filter handles standard <script> tags and common event handlers but misses alternate syntax forms. Attackers leverage these gaps to deliver JavaScript that executes in the victim's authenticated session context.

Attack Vector

An unauthenticated remote attacker submits crafted content through WikiLove functionality. When a victim views the affected wiki page or notification, the injected payload executes in their browser. The attacker can then hijack the session, perform actions as the victim, exfiltrate data, or deface wiki content. Refer to the Wikimedia Phabricator Task and Wikimedia Gerrit Commit for technical details on the affected code paths.

Detection Methods for CVE-2026-22711

Indicators of Compromise

Unexpected <script>, <svg>, <img>, or event-handler attributes in WikiLove message payloads stored in the database
Outbound browser requests from wiki users to attacker-controlled domains following WikiLove interactions
Anomalous session token activity originating from administrative or privileged wiki accounts

Detection Strategies

Audit MediaWiki database tables that store WikiLove messages for HTML-encoded payloads containing alternate XSS syntax
Inspect web server access logs for POST requests to WikiLove API endpoints containing suspicious encoded characters
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts

Monitoring Recommendations

Monitor MediaWiki application logs for elevated WikiLove activity from newly registered or anonymous accounts
Track browser console errors and CSP report-uri submissions across the wiki domain
Correlate authentication events with WikiLove interactions to identify session abuse patterns

How to Mitigate CVE-2026-22711

Immediate Actions Required

Upgrade the WikiLove extension to the patched version aligned with MediaWiki 1.43, 1.44, or 1.45 release branches
Apply the fix from the master branch directly if running a development build
Review and purge any stored WikiLove messages containing suspicious HTML or script content
Force session invalidation for users who interacted with WikiLove during the exposure window

Patch Information

Wikimedia Foundation remediated the issue on the master branch and backported the fix to release branches for MediaWiki 1.43, 1.44, and 1.45. The patch is available through the Wikimedia Gerrit Commit. Administrators should pull the latest WikiLove extension version compatible with their MediaWiki release.

Workarounds

Disable the WikiLove extension in LocalSettings.php until the patched version is deployed
Enforce a strict Content Security Policy that blocks inline script execution across the wiki
Restrict WikiLove usage to authenticated and trusted user groups through MediaWiki permission settings

bash

# Configuration example - disable WikiLove in LocalSettings.php
# Comment out or remove the following line:
# wfLoadExtension( 'WikiLove' );

# Optional: enforce CSP header via Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"