Cross-Site Scripting Vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents Extension

CVE-2026-39935

What is CVE-2026-39935?

An improper neutralization of input during the generation of web pages in the MediaWiki CampaignEvents Extension allows for Cross-Site Scripting (XSS) attacks. This vulnerability can enable an attacker to inject malicious scripts into web pages which could execute in the context of the user’s browser, leading to potential data theft or session hijacking. The affected versions include 1.43.7, 1.44.4, and 1.45.2, posing significant risks to web applications utilizing this extension.

References