CVE-2026-96875 is a stored cross-site scripting vulnerability in the Mediawiki Cargo extension affecting versions up to and including 3.9.4. The vulnerability arises from improper neutralization of input during web page generation, categorized under CWE-79. This flaw allows an attacker to inject malicious scripts that persist on the server and execute in the context of users visiting affected pages. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality and security controls, with no impact on integrity or availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of users' browsers, potentially enabling theft of session tokens, defacement, or other malicious actions within the scope of the affected web application. The impact is rated medium severity based on the CVSS score of 6.9, reflecting moderate risk without elevated privileges or user interaction requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of the Mediawiki Cargo extension should monitor the Wikimedia Foundation's advisories for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible.