Mediawiki Campaignevents Extension CVE-2026-39935

This is a classic reflected or stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a Mediawiki extension responsible for campaign event management. The CampaignEvents Extension fails to properly encode or sanitize user-supplied input before rendering it in HTML output, allowing attackers to break out of the intended context and inject malicious scripts. The vulnerability exists in multiple active versions (1.43.7, 1.44.4, and 1.45.2) of the extension, which suggests it likely affects the input handling logic across these versions. Since this is a Mediawiki extension rather than core, it is deployed only on instances where explicitly installed, limiting blast radius compared to core platform vulnerabilities.