Security readout for executives and security teams
Plain-English summary
CVE-2026-22710 is a low-severity stored cross-site scripting issue in Wikimedia’s MediaWiki Wikibase extension. Affected Wikibase versions may render unsafe content in autocomment system messages. Business impact is mainly limited user trust, data integrity, and session-risk concerns if a user views malicious stored content.
Executive priority
Treat this as routine patch management unless your Wikibase instance allows broad public editing or handles sensitive authenticated sessions. Prioritize validation and vendor guidance review, but this does not currently warrant emergency response based on provided evidence.
Technical view
The CVE describes CWE-79 improper neutralization during web page generation in MediaWiki Wikibase Extension versions 1.45, 1.44, 1.43, and 1.39. CVSS 4.0 score is 2.3. The vector indicates network reachability, low complexity, required attack conditions, no privileges, and required user interaction, with low confidentiality and integrity impact.
Likely exposure
Organizations running the Wikimedia Foundation MediaWiki Wikibase extension on versions 1.45, 1.44, 1.43, or 1.39 are the identified exposure group. Default status is listed as unaffected outside the named affected versions. Public sources do not identify specific configurations that increase exposure.
Exploitation context
No public source in the bundle states active exploitation, and the CVE is not listed as KEV. Exploitation requires a user to interact with affected content. The issue is stored XSS, so malicious content may persist until corrected, but the published severity remains low.
Researcher notes
Public details are limited to the CVE description, affected versions, CVSS vector, Phabricator task, and Gerrit query. Do not assume broader MediaWiki impact beyond the Wikibase extension versions named. The precise vulnerable code path and fixed release versions are not included in the supplied bundle.
Mitigation direction
- Inventory MediaWiki Wikibase extension deployments and identify affected versions.
- Review Wikimedia Phabricator task T409737 for vendor guidance and status.
- Review the linked Wikimedia Gerrit change for relevant patches or backports.
- Apply vendor-released updates or patches when available for your supported branch.
- Consider temporary risk controls around untrusted edits until vendor guidance is applied.
Validation and detection
- Confirm installed Wikibase extension version against the affected version list.
- Review whether autocomment system messages render user-influenced content.
- Verify vendor patch or update presence after remediation.
- Test that autocomment display safely neutralizes script-like input in a non-production environment.
- Monitor logs and content changes for suspicious stored markup patterns.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22710 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
2.3LowVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://phabricator.wikimedia.org/T409737CVE reference
- https://gerrit.wikimedia.org/r/q/I39d0074b2ad022b6efe6ab3dd8c8ec0f86c6c466CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.