CVE-2026-39935 The Wikimedia Foundation CVE debrief

Who should care

Users of the Mediawiki - CampaignEvents Extension, operators of affected systems, and security teams should be aware of this vulnerability and take necessary precautions to prevent exploitation. Review of compensating controls and monitoring is recommended while remediation is scheduled.

Technical summary

The CVE-2026-39935 vulnerability is a cross-site scripting (XSS) issue in the Mediawiki - CampaignEvents Extension. It occurs due to improper neutralization of input during web page generation, allowing for Cross-Site Scripting (XSS) attacks. The issue was remediated on the `master` branch. Affected deployments should be reviewed for exposure. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Users of the Mediawiki - CampaignEvents Extension, operators of affected systems, and security teams should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Defensive priority

Medium priority should be given to patching this vulnerability, as it has a CVSS score of 6.9 and is classified as MEDIUM severity.

Recommended defensive actions

• Apply the patch from the `master` branch
• Review and update the Mediawiki - CampaignEvents Extension to the latest version
• Implement additional security measures to prevent XSS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-04-07T23:16:27.380Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus. Further verification is recommended to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.