Stored XSS Vulnerability in WikiWorks Mediawiki Cargo Extension

CVE-2026-39837

What is CVE-2026-39837?

A vulnerability exists in the WikiWorks Mediawiki - Cargo Extension due to improper neutralization of script-related HTML tags. This flaw enables attackers to execute stored cross-site scripting (XSS) attacks, which can compromise the integrity of web pages and affect users accessing affected installations. Users of the Cargo Extension prior to version 3.8.7 are vulnerable and are advised to update their software and implement security best practices to mitigate potential risks.

References