CVE-2026-96874 is a stored cross-site scripting vulnerability in the Mediawiki - Cargo extension affecting versions up to and including 3.9.4. The vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79. This flaw allows attackers with limited privileges to inject malicious scripts that persist and execute when other users view affected pages. The CVSS 4.0 vector indicates network attack vector, high attack complexity, low confidentiality and integrity impact, and no availability impact.

The vulnerability allows stored XSS attacks, which can lead to execution of arbitrary scripts in the context of affected users' browsers. This may enable actions such as session hijacking or unauthorized actions performed on behalf of the user. However, the overall impact is rated low due to the high attack complexity and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the Wikimedia Foundation advisories for updates and apply any forthcoming patches promptly.