CVE-2026-58519

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.

Score

CVSS 4.0 6.9 Medium

Status

Analyzed - c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Published

2026-07-01

Last modified

2026-10-25

Weaknesses

CWE-79

Affected products

• Cargo (Mediawiki)
• Mediawiki - Cargo Extension (The Wikimedia Foundation)

References

• https://phabricator.wikimedia.org/T424140
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1277612