CVE-2026-96878: Cargo Exhibit field alias allows stored XSS
Published Sep 25, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.
This issue affects Mediawiki - Cargo extension: through 3.9.4.
Affected Software
1 affected component
MediaWiki Cargo extension<=3.9.4
Event History
Sep 25, 2026
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments should be assessed for exposure?
Assess MediaWiki installations using the Cargo extension at version 3.9.4 or earlier. The available information does not identify a fixed version.