CVE-2026-39933
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The GlobalWatchlist extension in MediaWiki from Wikimedia Foundation is vulnerable to XSS due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.
Risk Assessment
The organization is at risk of malicious script execution in the user's browser, potentially leading to session theft or data theft.
Recommendation
Upgrade MediaWiki to version 1.43, 1.44, or 1.45 with the appropriate fixes.
Other vulnerabilities in MediaWiki
See all- CVE-2026-34092High
A vulnerability in MediaWiki related to the exposure of sensitive information to unauthorized actors. It affects program files includes/Skin/Skin.Php.
- CVE-2026-34091High
CVE-2026-34091 describes an exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.
- CVE-2026-34088High
CVE-2026-34088 involves the exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.
- CVE-2017-8815High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- CVE-2017-8814High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by 'a lot of junk.'
- CVE-2017-8810High
MediaWiki versions before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provide different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.
- CVE-2012-4380High
MediaWiki versions before 1.18.5 and 1.19.x before 1.19.2 allow remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
- CVE-2016-6337High
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
- CVE-2016-6335High
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, allowing remote attackers to obtain sensitive information via a parse action to api.php.
- CVE-2016-6332High
MediaWiki versions before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, may allow remote attackers to obtain sensitive information by failing to terminate sessions when a user account is blocked.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS