CVE Catalog
CVE-2026-39841
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.16%
5th percentile - higher than 5% of all known CVEs
Summary
Stored XSS vulnerability in the Cargo extension for MediaWiki. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code that executes whenever the page is viewed.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the context of their account.
Recommendation
Update the Cargo extension to version 3.8.7 or later.
Original NVD description (English source)
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.