This vulnerability (CVE-2026-39935) involves improper input sanitization in the CampaignEvents Extension of Mediawiki, leading to cross-site scripting (CWE-79). The flaw allows attackers to inject malicious scripts into web pages generated by the extension. The issue affects multiple released versions but has only been fixed on the master development branch. No official remediation level or patch is currently documented, and the product is not a cloud service, so remediation depends on applying updates from the vendor.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing affected Mediawiki pages, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 4.0 base score of 6.9 reflects a medium severity with network attack vector, low privileges required, and no user interaction needed. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been fixed on the master branch, so upgrading to a version including this fix when officially released is recommended. Until then, consider restricting access to the affected extension or applying custom input sanitization as a temporary measure.