Cross-Site Scripting Vulnerability in Wikimedia Foundation's Mediawiki GlobalWatchlist Extension

CVE-2026-39933

What is CVE-2026-39933?

An improper neutralization of user input during the webpage generation in the Mediawiki GlobalWatchlist Extension of the Wikimedia Foundation has led to a Cross-Site Scripting (XSS) vulnerability. This security issue can allow attackers to inject malicious scripts into web pages viewed by users, potentially compromising sensitive information or redirecting users to harmful sites. The vulnerability specifically affects non-release branches of the extension, highlighting the importance of maintaining up-to-date releases to mitigate such security risks.

References