CVE-2026-96875

Received Received - Intake

Stored XSS in MediaWiki Cargo Extension

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: wikimedia-foundation

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-96875

Affected Vendors & Products

Vendor	Product	Version / Range
mediawiki	cargo_extension	to 3.9.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the MediaWiki Cargo extension versions up to 3.9.4. It occurs when user input is not properly neutralized during web page generation, allowing malicious scripts to be stored and executed when other users view the page.

Detection Guidance

Detection requires manual inspection of the MediaWiki Cargo extension version. Check installed extensions via the MediaWiki admin panel or database. Look for version 3.9.4 or earlier. No automated commands are provided in the CVE details.

Impact Analysis

An attacker could inject malicious scripts into pages served by the vulnerable MediaWiki Cargo extension. This could lead to unauthorized actions on behalf of users, theft of session cookies, or defacement of web pages. Users viewing affected pages may have their data compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using the affected extension may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade the MediaWiki Cargo extension to a version beyond 3.9.4. Remove or disable the extension if not needed. Review and sanitize user inputs in wiki pages to prevent XSS payloads.

Hi! I’m here to help you understand CVE-2026-96875. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70