Medium · 6.3 CVE-2026-39841 EUVD-2026-19931GHSA-2mg7-w9r8-29mw

Stored XSS through list fields on Cargo's page values and Special:CargoTables

Published Apr 7, 2026 · Updated Apr 7, 2026 · Assigned by wikimedia-foundation

Vendor: Wikimedia Foundation Product: Mediawiki - Cargo Extension Category: Web / CMS

Description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

Affected products

Vendor	Product	Affected	Fixed
Wikimedia Foundation	Mediawiki - Cargo Extension	< 3.8.7	3.8.7

Advisories 1

WID-SEC-2026-1043 MediaWiki Erweiterungen: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Apr 9, 2026

References

https://phabricator.wikimedia.org/T416389
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237973