CVE-2026-96876: Anonymous reflected XSS in CargoExport invalid-alias errors

Q: Which versions should be considered affected?

MediaWiki Cargo versions through 3.9.4 are affected.

Q: Does exploitation require an authenticated account?

No. The issue is described as anonymous, so an attacker does not need to authenticate to attempt exploitation.

Published Sep 25, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.

This issue affects Mediawiki - Cargo extension: through 3.9.4.

Affected Software

1 affected component

MediaWiki Cargo<=3.9.4

Event History

Sep 25, 2026

CVE Published

via MITRE·07:33 PM

Data Sourced

via MITRE·07:33 PM

DescriptionWeakness

Frequently Asked Questions

Which versions should be considered affected?

MediaWiki Cargo versions through 3.9.4 are affected.

Does exploitation require an authenticated account?

No. The issue is described as anonymous, so an attacker does not need to authenticate to attempt exploitation.