CVE-2026-39935
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.
Risk Assessment
The risk is the execution of malicious scripts in the victim's browser, potentially leading to session theft, redirects, or data theft.
Recommendation
Apply the patch from the `master` branch of MediaWiki or temporarily disable the CampaignEvents extension until an official update is released.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.