CVE-2024-40600: A stored XSS vulnerability exists in the Metrolook skin for MediaWiki, potentially allowing attackers to inject malicious scripts. This flaw, present in MediaWiki versions up to 1.42.1, stems from unsanitized input within MediaWiki:Sidebar top-level menu entries. Attackers can exploit this by injecting malicious JavaScript code that executes when other users view the affected sidebar.

While the CVSS score is 4.8, indicating a medium severity, the SOCRadar Vulnerability Risk Score (SVRS) is 38, suggesting the immediate risk might not be as critical as other vulnerabilities. However, given that the vulnerability is tagged as "In The Wild," administrators should still address this issue promptly to prevent potential account compromise or data theft. This XSS vulnerability can allow unauthorized actions by impersonating users and can compromise the MediaWiki installation. Mitigating this security risk requires patching to the latest version of MediaWiki or applying appropriate sanitization to user-supplied sidebar content.