XSS in Lihaohong6 Renderblocking
CVE-2026-30977
RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS in renderblocking-css with Inline Assets mode. $wgRenderBlockingInlineAssets = true and editsitecss user rights are required. This vulnerability is fixed in 0.1.1.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.005 (38.2th percentile) — read the EPSS interpretation.
Affected products
- Lihaohong6 Renderblocking — versions < 0.1.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)