The Mediawiki Cargo extension through version 3.9.4 contains a reflected cross-site scripting vulnerability (CWE-79) due to improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that are reflected back to users, potentially leading to script execution in the context of the affected web application. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality with no impact on integrity or availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser within the context of the vulnerable Mediawiki Cargo extension, potentially leading to session hijacking or other client-side attacks. However, the impact is limited to reflected XSS with low confidentiality impact and no integrity or availability impact as per the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor the Wikimedia Foundation advisories for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible.