CVE-2026-103437

DiscoveredSep 30, 2026UpdatedSep 30, 2026

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

View graph Watch Export

CVSS v3.1

—

EPSS

0.31%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Oct 2, 2026 → Oct 26, 2026

▼ 0.09pp

0.40% → 0.31% over 3 tracked changes

Connections

1 relationships

CWE-80

source

Timeline

disclosure → media coverage

Sep 30, 2026

Disclosure — published as a CVE record.

Public PoC (1)

github.com/BomboBombone/CVE-2026-103437

Unverified third-party code — review before executing.