CVE-2026-39838 MEDIUM

CVE-2026-39838: ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS

Vendor Wikimedia Foundation
Product MediaWiki - ProofreadPage Extension
Weakness CWE-79 · XSS
Published April 7, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Key dates

02Disclosure timeline

April 7, 2026 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-4816 Reflected Cross Site Scripting (XSS) vulnerability in Support Board CVE-2025-58658 WordPress Proof Factor – Social Proof Notifications Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability CVE-2024-3831 Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget CVE-2025-58025 WordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) Vulnerability CVE-2024-26091 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)