Low severityNVD Advisory· Published Sep 25, 2026

CVE-2026-96874

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS.

This issue affects Mediawiki - Cargo extension: through 3.9.4.

Patches

Vulnerability mechanics

References

gerrit.wikimedia.org/g/mediawiki/extensions/Cargonvd
phabricator.wikimedia.org/T435207nvd

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000