CVE-2026-39838
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The ProofreadPage extension for MediaWiki is vulnerable to Cross-Site Scripting (XSS) targeting non-script elements. The issue is fixed in the master branch and in MediaWiki versions 1.43, 1.44, and 1.45.
Risk Assessment
An attacker can inject malicious HTML/JavaScript that executes in the victim's browser, leading to session theft or content manipulation.
Recommendation
Update MediaWiki to version 1.43, 1.44, or 1.45, which include the fix for the ProofreadPage extension.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.