CVE-2026-14358: Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title
Published Jul 1, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS).
This issue affects Mediawiki - Charts Extension: from before 1.43.9,1.44.6,1.45.4.
Affected Software
4 affected components
Wikimedia Foundation Mediawiki - Charts Extension>1.43.9<1.44.6, >1.44.6<1.45.4, <=1.43.9, <=1.44.6, <=1.45.4
MediaWiki MediaWiki>=1.43.0<1.43.9
MediaWiki MediaWiki>=1.44.0<1.44.6
MediaWiki MediaWiki>=1.45.0<1.45.4
Event History
Jul 1, 2026
CVE Published
via MITRE·06:48 PM
Data Sourced
via MITRE·06:48 PM
DescriptionWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-14358?
The severity of CVE-2026-14358 is rated as medium with a CVSS score of 6.9.
2
What type of vulnerability is identified in CVE-2026-14358?
CVE-2026-14358 identifies a Stored Cross-Site Scripting (XSS) vulnerability.
3
How do I fix CVE-2026-14358?
To fix CVE-2026-14358, upgrade the Mediawiki - Charts Extension to a version equal to or greater than 1.43.9, 1.44.6, or 1.45.4.
4
Which software is affected by CVE-2026-14358?
CVE-2026-14358 affects The Wikimedia Foundation Mediawiki - Charts Extension.
5
When was CVE-2026-14358 published?
CVE-2026-14358 was published on July 1, 2026.