The Mediawiki Cargo extension versions prior to 3.9.5 contain a stored XSS vulnerability caused by improper input neutralization during web page generation. This flaw allows attackers with limited privileges to inject malicious scripts that are stored and subsequently executed in the context of other users viewing the affected pages. The vulnerability is tracked as CVE-2026-96874 and classified under CWE-79. The CVSS 4.0 vector indicates network attack vector, high attack complexity, low confidentiality and integrity impact, and low availability impact, resulting in an overall low severity rating.

The vulnerability enables stored cross-site scripting attacks, which can lead to the execution of arbitrary scripts in the context of users viewing affected pages. This may allow attackers to perform actions such as session hijacking or defacement within the scope of the Mediawiki Cargo extension. However, the CVSS assessment rates the overall impact as low, indicating limited confidentiality, integrity, and availability consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the vulnerable extension or applying input validation controls if feasible.