CVE-2026-39933

MediumCVSS 6.9

Published: 07/04/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

The GlobalWatchlist extension in MediaWiki from Wikimedia Foundation is vulnerable to XSS due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

Risk Assessment

The organization is at risk of malicious script execution in the user's browser, potentially leading to session theft or data theft.

Recommendation

Upgrade MediaWiki to version 1.43, 1.44, or 1.45 with the appropriate fixes.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.