Medium · 6.3 CVE-2026-39837 EUVD-2026-19927GHSA-6m53-gpj2-w66j

Stored XSS through the dynamic table format in Cargo

Published Apr 7, 2026 · Updated Apr 7, 2026 · Assigned by wikimedia-foundation

Vendor: Wikimedia Foundation Product: Mediawiki - Cargo Extension Category: Web / CMS

Description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

Affected products

Vendor	Product	Affected	Fixed
Wikimedia Foundation	Mediawiki - Cargo Extension	< 3.8.7	3.8.7

Advisories 1

WID-SEC-2026-1043 MediaWiki Erweiterungen: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Apr 9, 2026

References

https://phabricator.wikimedia.org/T416402
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237979