CVE-2026-39839
6.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Summary
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Wikimedia Foundation | Mediawiki - Cargo Extension | 0 < 3.8.7 | affected |
Weaknesses
- CWE-80: CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
References
- https://phabricator.wikimedia.org/T416271
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237957
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237977
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.