This vulnerability (CVE-2026-39838) affects the ProofreadPage Extension of MediaWiki by Wikimedia Foundation. It is classified as CWE-79, indicating improper neutralization of input during web page generation, which leads to cross-site scripting (XSS). The issue allows injection of malicious input that can affect non-script elements on web pages generated by the extension. The CVSS 4.0 vector indicates the attack is network-based with low complexity and no privileges or user interaction required, but with low confidentiality and integrity impact and limited scope. No affected versions or patches are specified in the available data.

Successful exploitation could allow an attacker to execute cross-site scripting attacks targeting non-script elements within the MediaWiki ProofreadPage Extension. This may lead to limited confidentiality and integrity impact as indicated by the CVSS vector. There are no known exploits in the wild, and the vulnerability does not require user interaction or privileges to exploit.

Patch status is not yet confirmed — check the Wikimedia Foundation vendor advisory for current remediation guidance. Until an official fix is released, users should monitor official channels for updates. No specific temporary mitigations are provided in the available data.