CVE-2026-39936 The Wikimedia Foundation CVE debrief

Who should care

Users of The Wikimedia Foundation Mediawiki - Score Extension should review their installations for exposure and apply patches or mitigations as necessary. The vulnerability has a CVSS score of 6.9, indicating a medium severity. Operators, administrators, and security teams responsible for MediaWiki installations should prioritize reviewing and applying patches or mitigations.

Technical summary

The vulnerability is caused by improper neutralization of input during web page generation, allowing for Cross-Site Scripting (XSS) attacks. The issue has been addressed in MediaWiki versions 1.43, 1.44, and 1.45. The affected product is The Wikimedia Foundation Mediawiki - Score Extension. The vulnerability has a CVSS score of 6.9, indicating a medium severity. Users should review their installations and apply patches or mitigations as necessary.

Defensive priority

Medium priority given the CVSS score of 6.9 and the availability of patches.

Recommended defensive actions

• Review and apply patches for MediaWiki versions 1.43, 1.44, and 1.45
• Implement input validation and sanitization for user-supplied data
• Monitor for suspicious activity and implement compensating controls as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-07T23:16:27.530Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Awaiting Analysis. The Wikimedia Foundation Mediawiki - Score Extension has a cross-site scripting vulnerability. Users should verify their installations and apply patches or mitigations as necessary. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45. However, the specific details about the vulnerability and the affected versions are limited.

Official resources