CVE-2026-39839 is a stored cross-site scripting (XSS) vulnerability in the Mediawiki Cargo Extension prior to version 3.8.7, caused by improper neutralization of script-related HTML tags in web pages. An attacker can inject malicious scripts that persist in the application and execute in users' browsers when they view affected content. The vulnerability carries a CVSS score of 6.1 (Medium), with a network-based attack vector requiring no special privileges but needing user interaction to trigger. While the attack complexity is low and requires no authentication, the impact is limited to confidentiality and integrity compromise with no availability impact. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog and shows no indication of active exploitation in the wild. The EPSS score of 0.00028 suggests extremely low real-world exploitation probability, and community attention remains minimal as indicated by its inactive status on threat intelligence platforms.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.8.7CPE matchmatch criteria | cpe:2.3:a:mediawiki:cargo:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.