Unrated severityNVD Advisory· Published Jul 1, 2026· Updated Jul 10, 2026

Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

CVE-2026-14358

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS).

This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.

Affected products

Wikimedia Foundation/Mediawiki - Charts Extensionllm-create
Range: <1.43.9, 1.44.6, 1.45.4

Patches

Vulnerability mechanics

References

gerrit.wikimedia.org/r/q/Ibdaa7c852ae83f562e84dddc9c96ad64e2152210mitre
phabricator.wikimedia.org/T430548mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000