Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

MediaWiki Cargo extension can run malicious code in tab names

CVE-2026-96874 · published 24 days ago
Summary

The Cargo add‑on for MediaWiki lets an attacker store harmful script code in the names of drill‑down tabs, which will run whenever a user views the page. This could let attackers steal data or take actions as the logged‑in user. Update the Cargo extension to the latest version or disable the feature until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
the wikimedia foundation mediawiki - cargo extension <= 3.9.4
Original advisory text
Stored XSS in Cargo Drilldown tab names
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS.






This issue affects Mediawiki - Cargo extension: through 3.9.4.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published25 Sep 2026
Updated19 Oct 2026
First seen25 Sep 2026
Sources
CVE-2026-96874 · NVD
CVE-2026-96874 · MITRE
Track software like this
Free during beta