DeutschShown in its original language — a full translation is planned for a future version.
MediaWiki Erweiterungen: Mehrere Schwachstellen ermöglichen Cross-Site Scripting
view advisory published 2026-04-09
Ein Angreifer kann mehrere Schwachstellen in MediaWiki Extensions ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-39936US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripti… | ||||
| CVE-2026-39935US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Sit… | ||||
| CVE-2026-39937US | — | — | ||
Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The… | ||||
| CVE-2026-39934US | — | — | ||
Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of… | ||||
| CVE-2026-39933US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Si… | ||||
| CVE-2026-39841US | medium6.1 | — | ||
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects… | ||||
| CVE-2026-39840US | medium6.1 | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Scri… | ||||
| CVE-2026-39839US | medium6.1 | — | ||
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects… | ||||
| CVE-2026-39838US | — | — | ||
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting… | ||||
| CVE-2026-39837US | medium5.4 | — | ||
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki… | ||||
| CVE-2026-5762US | — | — | ||
Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS.
This issue was remediated only on t… | ||||
| CVE-2026-22711US | — | — | ||
Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remedi… | ||||
| CVE-2026-30977US | — | — | ||
RenderBlocking is a MediaWiki extension that allows interface administrators to specify render-blocking CSS and JavaScript. Prior to 0.1.1, there is Stored XSS in renderblocking-cs… | ||||
02
references
External citations — patches, advisories, analysis.
- EU Vulnerability Database EUVD-2026-19851 vom 2026-04-09external
- EU Vulnerability Database EUVD-2026-19889 vom 2026-04-09external
- EU Vulnerability Database EUVD-2026-19891 vom 2026-04-09external
- EU Vulnerability Database EUVD-2026-19897 vom 2026-04-09external
- EU Vulnerability Database EUVD-2026-19927 vom 2026-04-09external
- EU Vulnerability Database EUVD-2026-19929 vom 2026-04-09external
- EU Vulnerability Database EUVD-2026-19931 vom 2026-04-09external
- EU Vulnerability Database EUVD-2026-19976 vom 2026-04-09external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan