CVE-2026-39935 — XSS-via-i18n in localised wiki names

CVE-2026-39935

XSS-via-i18n in localised wiki names PUBLISHED

Description (CNA)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.

Affected (CNA)

Vendor / product	Versions
The Wikimedia Foundation / Mediawiki - CampaignEvents Extension	affected 1.43; affected 1.44; affected 1.45; affected 0 before 1.43

CWE

CWE-79

References

https://phabricator.wikimedia.org/T418254
https://gerrit.wikimedia.org/r/c/1249320

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.