CVE-2026-39837

MediumCVSS 5.4

Published: 07/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Cargo extension for MediaWiki is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of script-related HTML tags.

Risk Assessment

Attackers can inject malicious scripts that execute in other users' browsers, potentially leading to data theft or account takeover.

Recommendation

Update the Cargo extension for MediaWiki to version 3.8.7 or later.

Original NVD description (English source)

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.