CVE-2026-39935

Name of the Vulnerable Software and Affected Versions Mediawiki - CampaignEvents Extension versions 1.43.7, 1.44.4, and 1.45.2

Description The Wikimedia Foundation Mediawiki - CampaignEvents Extension is susceptible to a cross-site scripting (XSS) issue due to improper input neutralization during web page generation. This allows for the injection of malicious scripts into web pages viewed by other users.

Recommendations Update to a newer version of the Mediawiki - CampaignEvents Extension that addresses this issue. As a temporary workaround, carefully sanitize all user-supplied input before rendering it in web pages.