Wikimedia MediaWiki AJAX Poll Extension Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Wikimedia Foundation's MediaWiki AJAX Poll Extension, affecting versions 1.39 through 1.43. The issue arises from improper input validation, which allows XSS payloads to be injected and executed.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, set a system message that is used by the AJAX Poll Extension to an XSS payload. Then, render a poll that displays this message. The injected script will be executed, demonstrating the cross-site scripting vulnerability.

Remediation

Users can update to the latest version of the MediaWiki AJAX Poll Extension, where this vulnerability has been addressed.