CVE-2026-39936

MediumCVSS 6.9

Published: 07/04/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

The Score extension in MediaWiki (The Wikimedia Foundation) is vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session theft or content modification.

Recommendation

Update MediaWiki to version 1.43, 1.44, or 1.45 which contain the fix.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.