Cyber Resilience

CVE-2026-22711

XSS

XSS
Published
07 April 2026
Modified
21 July 2026
CVSS Score v4 6.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0029 22th percentile
Risk Priority 40 floored blend · peak EPSS

Summary

CVE-2026-22711 is a medium-severity Improper Neutralization of Alternate XSS Syntax (CWE-87) vulnerability. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

CWE(s)
CWE-87

Related Threats

MITRE ATT&CK Enterprise Techniques

T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-3666Shared CWE-87
CVE-2024-2657Shared CWE-87
CVE-2025-14732Shared CWE-87
CVE-2023-35158Shared CWE-87
CVE-2025-8561Shared CWE-87
CVE-2026-42458Shared CWE-87
CVE-2026-40321Shared CWE-87
CVE-2026-25688Shared CWE-87
CVE-2026-45314Shared CWE-87
CVE-2026-33510Shared CWE-87

Affected Assets

—
MediaWiki
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

SA-11 requires developer testing and analysis that can discover improper neutralization of alternate script syntax after it has been coded.

SI-10 Information Input Validation good match

SI-10 directly requires validation/sanitization of untrusted inputs, which structurally stops alternate XSS syntax from reaching the interpreter.

SA-8 Security and Privacy Engineering Principles partial match

SA-8 mandates secure engineering principles such as input neutralization and output encoding that prevent introduction of this class of flaw.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper input neutralization and output encoding to prevent alternate XSS syntax.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.28 Secure coding mostly match
prevents

Secure coding standards require proper neutralization of alternate script syntax, directly eliminating CWE-87.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing catches residual XSS but does not itself implement the neutralization controls.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates input validation and output encoding that directly prevent alternate XSS syntax.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for neutralization of untrusted input to block XSS variants.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles reduce attack surface but do not prescribe specific encoding rules.

References