CVE-2026-39841

CVE-2026-39841 is a Stored Cross-Site Scripting (XSS) vulnerability in the Mediawiki Cargo Extension that allows improper neutralization of script-related HTML tags. This vulnerability affects Mediawiki Cargo Extension versions prior to 3.8.7 and could enable attackers to inject and execute malicious scripts that persist in the application. The vulnerability carries a CVSS 3.1 score of 6.1 (MEDIUM severity) with a network-based attack vector requiring no special privileges but user interaction to exploit. The attack has low complexity and could result in limited confidentiality and integrity impacts with no availability impact, though the changed scope indicates the vulnerability could affect resources beyond the vulnerable component. Regarding exploitation status, this vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows minimal community attention, classified as inactive on threat tracking lists. The EPSS score of 0.00028 indicates extremely low probability of exploitation in the wild, suggesting the vulnerability has not yet been actively weaponized despite the relative straightforwardness of XSS exploitation techniques.