Medium · 5.1 CVE-2026-39840 EUVD-2026-19929GHSA-8m8x-w498-p4wx

CSS injection in multiple Cargo display formats

Published Apr 7, 2026 · Updated Apr 7, 2026 · Assigned by wikimedia-foundation

Vendor: Wikimedia Foundation Product: Mediawiki - Cargo Extension Category: Web / CMS

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

Affected products

Vendor	Product	Affected	Fixed
Wikimedia Foundation	Mediawiki - Cargo Extension	< 3.8.7	3.8.7

Advisories 1

WID-SEC-2026-1043 MediaWiki Erweiterungen: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Apr 9, 2026

References

https://phabricator.wikimedia.org/T416368
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237966