Cross-Site Scripting Flaw in Wikimedia Foundation Mediawiki - Cargo Extension

CVE-2026-39839

What is CVE-2026-39839?

The Mediawiki - Cargo Extension of the Wikimedia Foundation is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of script-related HTML tags in web pages. This can lead to stored XSS attacks, where malicious scripts are stored and executed when users access impacted pages. Affected versions are those prior to 3.8.7, making it imperative for users to update their installations to ensure protection against this security issue.

References