PT-2026-30991 · Wikimedia Foundation · Mediawiki Proofreadpage Extension

Somerandomdeveloper · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39838

Mitre

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements.This issue affects .

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39838

Affected Products

Mediawiki Proofreadpage Extension

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39838 · Security Note
• https://gerrit.wikimedia.org/r/q/Idd51e18479b32b7176b43ff74ca1c49d6bdd0628 · Note
• https://phabricator.wikimedia.org/T406088 · Note