CVE-2026-39935

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39935", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-04-07T21:25:36.589Z", "datePublished": "2026-04-07T22:04:02.098Z", "dateUpdated": "2026-04-08T22:06:48.795Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-04-08T22:06:48.795Z"}, "title": "XSS-via-i18n in localised wiki names", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - CampaignEvents Extension", "versions": [{"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}, {"status": "affected", "version": "0", "lessThan": "1.43", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS).\u00a0This issue was remediated only on the `master` branch.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch."}]}], "references": [{"url": "https://phabricator.wikimedia.org/T418254"}, {"url": "https://gerrit.wikimedia.org/r/c/1249320"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "Daimona", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T14:05:08.221177Z", "id": "CVE-2026-39935", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:05:53.360Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39935", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:05:08.221177Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:05:14.472Z"}}], "cna": {"title": "XSS-via-i18n in localised wiki names", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Daimona"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - CampaignEvents Extension", "versions": [{"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}, {"status": "affected", "version": "0", "lessThan": "1.43", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://phabricator.wikimedia.org/T418254"}, {"url": "https://gerrit.wikimedia.org/r/c/1249320"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS).\u00a0This issue was remediated only on the `master` branch.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-04-08T22:06:48.795Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39935", "state": "PUBLISHED", "dateUpdated": "2026-04-08T22:06:48.795Z", "dateReserved": "2026-04-07T21:25:36.589Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-04-07T22:04:02.098Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Mediawiki - CampaignEvents Extension", "vendor": "The Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}, {"lessThan": "1.43", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS).\u00a0This issue was remediated only on the `master` branch."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web ('cross-site scripting') vulnerabilidad en la extensi\u00f3n CampaignEvents de Mediawiki de The Wikimedia Foundation permite Cross-Site Scripting (XSS). Este problema afecta a la extensi\u00f3n CampaignEvents de Mediawiki: 1.43.7, 1.44.4, 1.45.2."}], "id": "CVE-2026-39935", "lastModified": "2026-07-21T19:10:00.107", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39935", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T14:05:08.221177Z", "version": "2.0.3"}}]}, "published": "2026-04-07T23:16:27.380", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "url": "https://gerrit.wikimedia.org/r/c/1249320"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "url": "https://phabricator.wikimedia.org/T418254"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.44.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.45.2"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 94.0, "source": "matching"}]}, "original": {"product": "Mediawiki - CampaignEvents Extension", "source": "cna", "vendor": "The Wikimedia Foundation"}, "product": "mediawiki-campaignevents_extension", "vendor": "wikimedia"}], "analysis": {"en": {"generated_at": "2026-04-08T23:52:43.646653+00:00", "value": {"mitigation_remediation": ["Deploy the patched release of the CampaignEvents extension from the master branch or an official release that includes the fix."], "summary": {"action": "Apply patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The bug resides in the CampaignEvents extension of the MediaWiki platform maintained by the Wikimedia Foundation. No individual versions are cited, but the fix was applied only on the master branch; therefore, all releases built from older baselines remain affected until the updated code is deployed.", "description_and_impact": "Proper handling of user input is essential for safe web page rendering. The CampaignEvents extension fails to neutralize characters used in localized wiki names, allowing injected code to appear in the output HTML. When a victim\u2019s browser renders the impacted page, the injected code is executed in that user\u2019s context. The nature of the vulnerability permits the execution of arbitrary scripts in the browser running the affected page.", "risk_and_exploitability": "The CVSS base score of 6.9 signals a moderate severity level. An EPSS score of less than 1\u00a0% indicates a low probability of exploitation in the wild, and the defect is not yet listed in the CISA KEV catalog. The likely attack path involves an attacker supplying a malicious string in a wiki name field that is subsequently incorporated into a web page for other users. Existence of this vector requires that the manipulated field be accessible to non\u2011trusted users, which raises the risk profile for sites that allow open editing of wiki names but mitigates it for tightly controlled deployments."}}}}, "created": "2026-04-08T19:45:14.863322+00:00", "updated": "2026-04-09T08:28:35.894485+00:00", "vendors": ["wikimedia", "wikimedia$PRODUCT$mediawiki-campaignevents_extension"]}