Skip to main content

MediaWiki Cargo Extension CVE-2026-58519

| EUVDEUVD-2026-40901 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-01 wikimedia-foundation GHSA-r23x-87q7-xq2f
XSS Mediawiki Cargo Extension
6.9
CVSS 4.0 · Vendor: wikimedia-foundation
Share

Severity by source

Vendor (wikimedia-foundation) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Network-reachable stored XSS with no complexity; PR:N reflects open-editing wikis; UI:R required as victim must load the poisoned page; scope changes to browser context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 01, 2026 - 06:01 EUVD
Analysis Generated
Jul 01, 2026 - 05:26 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.

This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.

AnalysisAI

Stored cross-site scripting in the Wikimedia Foundation's MediaWiki Cargo Extension (all versions before 3.9.1) allows attackers to inject persistent malicious scripts into wiki pages rendered through the Cargo data-display system. The CVSS 4.0 vector carries E:A (evidence of active exploitation), elevating this beyond a theoretical risk. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain wiki editing access (or use anonymous editing)
Delivery
Inject script payload into a Cargo-tracked structured data field
Exploit
Cargo stores unsanitized payload in database
Execution
Victim loads a wiki page rendering the Cargo query
Persist
Browser executes injected script
Impact
Exfiltrate session token or deliver secondary payload
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Cargo Extension must be installed and active on the MediaWiki instance. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.9 and the E:A exploitation evidence modifier together indicate an actively exploited, medium-high severity vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with editing access (or none, if anonymous editing is enabled) submits a Cargo-tracked wiki page containing a malicious payload such as a script tag within a structured data field - for example, a Cargo table value like a name or description field. The Cargo extension stores this unsanitized value in its database. …
Remediation Upgrade the MediaWiki Cargo Extension to version 3.9.1 or later, which incorporates the fix committed in Gerrit change 1277612 (https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1277612). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mediawiki Cargo Extension

View all
CVE-2026-14363 MEDIUM
6.9 Jul 01

SQL injection in the Wikimedia Foundation's MediaWiki Cargo Extension exposes wiki deployments to unauthenticated databa
CVE-2026-58521 MEDIUM
6.9 Jul 01

SQL injection in the Wikimedia Foundation's Cargo Extension for MediaWiki exposes all installations running versions pri
CVE-2026-39837 MEDIUM
6.3 Apr 07

Stored cross-site scripting (XSS) in the Mediawiki Cargo Extension before version 3.8.7 allows authenticated users to in
CVE-2026-39841 MEDIUM
6.3 Apr 07

Stored XSS vulnerability in Wikimedia Cargo Extension before 3.8.7 allows authenticated users with page editing permissi
CVE-2026-39839 MEDIUM
6.3 Apr 07

Stored XSS in Wikimedia Cargo Extension before 3.8.7 allows authenticated users with page editing privileges to inject m
CVE-2026-39840 MEDIUM
5.1 Apr 07

Cross-site scripting (XSS) vulnerability in Mediawiki Cargo Extension before version 3.8.7 allows authenticated users to

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2026-58519 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy