This vulnerability (CVE-2026-39838) is an instance of CWE-79, where the ProofreadPage Extension in MediaWiki fails to properly neutralize input during web page generation, leading to cross-site scripting (XSS) attacks. The issue allows injection of malicious content into non-script elements of web pages, potentially impacting users who view affected pages. The Wikimedia Foundation has remediated this vulnerability in the master branch and in release branches 1.43, 1.44, and 1.45 of MediaWiki. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality and integrity impact, and low scope impact. No known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected MediaWiki ProofreadPage Extension, potentially leading to information disclosure or manipulation of web content for users viewing the affected pages. The impact is rated medium severity with low confidentiality and integrity impact according to the CVSS 4.0 score of 6.9. There are no reports of active exploitation in the wild.

The vulnerability has been fixed in the master branch and release branches 1.43, 1.44, and 1.45 of MediaWiki. Users should upgrade to one of these fixed versions to remediate the issue. Since this is not a cloud service, remediation requires applying the updated software versions. Patch status is not explicitly confirmed beyond the stated fixed branches; therefore, users should consult the official Wikimedia Foundation advisories for the latest remediation guidance.