The vulnerability CVE-2026-39936 affects the Mediawiki Score Extension by allowing cross-site scripting due to improper input neutralization during web page generation. This can enable attackers to inject malicious scripts into web pages served by the extension. The Wikimedia Foundation has remediated this vulnerability in the master branch and in release branches for MediaWiki versions 1.43, 1.44, and 1.45. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, availability, scope, and security requirements. No explicit vendor advisory or patch links are provided, but the fix is confirmed in the source branches.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing affected Mediawiki pages, potentially leading to session hijacking, defacement, or other client-side impacts. The medium CVSS score reflects moderate risk due to ease of exploitation and potential impact on confidentiality, integrity, and availability. There are no reports of known exploits in the wild.

The vulnerability has been remediated in the master branch and in release branches for MediaWiki versions 1.43, 1.44, and 1.45. Users should upgrade to one of these fixed versions to mitigate the risk. Since no explicit vendor advisory or patch links are provided, users should consult the official Wikimedia Foundation Mediawiki repositories or release notes for the relevant patches and upgrade instructions. Patch status is not yet confirmed by a vendor advisory; verify current remediation guidance from official sources before deployment.