This vulnerability (CWE-79) in the Mediawiki Cargo extension allows reflected XSS due to improper input sanitization during web page generation. An attacker could potentially inject malicious scripts that are reflected back to users. The issue affects all versions up to 3.9.4. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, with no impact on integrity or availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions limited by the reflected nature of the XSS. However, the impact is rated medium due to the low confidentiality impact and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the data, users should monitor the Wikimedia Foundation's advisories for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible.