CVE-2026-39840

CVE-2026-39840 is a cross-site scripting (XSS) vulnerability in the Mediawiki Cargo Extension that allows attackers to inject malicious scripts through improper input neutralization during web page generation, affecting all versions prior to 3.8.7. The vulnerability is classified as MEDIUM severity with a CVSS score of 6.1, requiring only network access and user interaction to exploit, resulting in limited confidentiality and integrity impacts without availability impact. The exploitation status remains minimal, with no evidence of active exploitation in the wild, no public exploit code availability, and relatively low community attention reflected in its EPSS score of 0.0003 and FAUCET Risk Score of 34.0 out of 100.