PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39935 The Wikimedia Foundation CVE debrief

A cross-site scripting vulnerability was found in the Mediawiki - CampaignEvents Extension. The issue allows for Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability was remediated on the `master` branch. Users should review the official advisory for affected scope and vendor guidance. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Affected deployments should be reviewed for exposure and patched as soon as possible. Review of compensating controls and monitoring is recommended while remediation is scheduled.

Vendor
The Wikimedia Foundation
Product
Mediawiki - CampaignEvents Extension
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-21
Advisory published
2026-04-07
Advisory updated
2026-07-21

Who should care

Users of the Mediawiki - CampaignEvents Extension, operators of affected systems, and security teams should be aware of this vulnerability and take necessary precautions to prevent exploitation. Review of compensating controls and monitoring is recommended while remediation is scheduled.

Technical summary

The CVE-2026-39935 vulnerability is a cross-site scripting (XSS) issue in the Mediawiki - CampaignEvents Extension. It occurs due to improper neutralization of input during web page generation, allowing for Cross-Site Scripting (XSS) attacks. The issue was remediated on the `master` branch. Affected deployments should be reviewed for exposure. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Users of the Mediawiki - CampaignEvents Extension, operators of affected systems, and security teams should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Defensive priority

Medium priority should be given to patching this vulnerability, as it has a CVSS score of 6.9 and is classified as MEDIUM severity.

Recommended defensive actions

  • Apply the patch from the `master` branch
  • Review and update the Mediawiki - CampaignEvents Extension to the latest version
  • Implement additional security measures to prevent XSS attacks
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-04-07T23:16:27.380Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus. Further verification is recommended to confirm affected scope and severity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-07T23:16:27.380Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.