CVE-2026-14358 — Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

CVE-2026-14358

Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title PUBLISHED

Description (CNA)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.

Affected (CNA)

Vendor / product	Versions
The Wikimedia Foundation / Mediawiki - Charts Extension	affected * before 1.43.9,1.44.6,1.45.4

CWE

CWE-79

References

https://phabricator.wikimedia.org/T430548
https://gerrit.wikimedia.org/r/q/Ibdaa7c852ae83f562e84dddc9c96ad64e2152210

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.