CVE-2026-96875: Reflected XSS in Cargo Drilldown hierarchy filters

Q: Which releases should be considered affected during triage?

The affected range is stated as MediaWiki Cargo extension versions through 3.9.4. The provided data does not identify a fixed release.

Q: Is the issue reflected XSS or stored XSS?

The title describes reflected XSS, while the description describes stored XSS. The provided record does not resolve this discrepancy, so both the advisory details and the referenced report should be reviewed before assigning exploit assumptions.

Published Sep 25, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS.

This issue affects Mediawiki - Cargo extension: through 3.9.4.

Affected Software

1 affected component

MediaWiki Cargo extension<=3.9.4

Event History

Sep 25, 2026

CVE Published

via MITRE·07:29 PM

Data Sourced

via MITRE·07:29 PM

DescriptionWeakness

Frequently Asked Questions

Which releases should be considered affected during triage?

The affected range is stated as MediaWiki Cargo extension versions through 3.9.4. The provided data does not identify a fixed release.

Is the issue reflected XSS or stored XSS?

The title describes reflected XSS, while the description describes stored XSS. The provided record does not resolve this discrepancy, so both the advisory details and the referenced report should be reviewed before assigning exploit assumptions.