CVE-2026-39933 The Wikimedia Foundation CVE debrief

Who should care

Users of Mediawiki - GlobalWatchlist Extension, particularly those responsible for maintaining and securing MediaWiki installations, should review their deployments for exposure and apply patches or mitigations as necessary. This includes administrators, security teams, and operators who manage MediaWiki environments.

Technical summary

The CVE-2026-39933 vulnerability is classified as a Cross-Site Scripting (XSS) issue. It arises from improper neutralization of input during web page generation in the Mediawiki - GlobalWatchlist Extension. The Common Vulnerability Scoring System (CVSS) score is 6.9, indicating a medium severity level. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it allows for Cross-Site Scripting (XSS) attacks.

Recommended defensive actions

• Review and apply patches for MediaWiki versions 1.43, 1.44, and 1.45, and the `master` branch.
• Implement input validation and output encoding for user-supplied data in the GlobalWatchlist Extension.
• Monitor for suspicious activity and implement compensating controls if patching is not immediately feasible.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-04-07T22:16:23.980Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Awaiting Analysis. The issue has been remediated on the `master` branch and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.