CVE-2026-58519
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability has been found in the Cargo extension for MediaWiki. The flaw is caused by improper input neutralization during web page generation. All versions before 3.9.1 are affected.
Risk Assessment
An attacker can inject malicious JavaScript code that executes in the browsers of other users visiting compromised pages. This could lead to session theft, account takeover, or malware distribution.
Recommendation
Immediately update the Cargo extension to version 3.9.1 or later. If possible, temporarily disable the extension before applying the update.
Other vulnerabilities in MediaWiki - Cargo Extension
See all- CVE-2026-14363Critical
An SQL injection vulnerability in the Cargo extension for MediaWiki allows an attacker to inject malicious SQL code. The issue affects versions before 1.43.9, 1.44.6, and 1.45.4.
- CVE-2026-58521Critical
A SQL injection vulnerability was found in the Cargo extension for MediaWiki due to improper neutralization of special elements in SQL commands. The issue affects versions before 1.43.9, 1.44.6, and 1.45.4.
- CVE-2026-39841Medium
Stored XSS vulnerability in the Cargo extension for MediaWiki. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code that executes whenever the page is viewed.
- CVE-2026-39840Medium
XSS vulnerability in the Cargo extension for MediaWiki, targeting non-script elements. Improper input neutralization during page generation allows injection of malicious code.
- CVE-2026-39839Medium
The Cargo extension for MediaWiki before version 3.8.7 is vulnerable to stored XSS due to improper neutralization of script-related HTML tags. Attackers can inject malicious scripts that execute when a page is viewed.
- CVE-2026-39837Medium
The Cargo extension for MediaWiki is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of script-related HTML tags.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.