CVE-2026-96875 The Wikimedia Foundation CVE debrief

Who should care

Defenders responsible for Mediawiki - Cargo extension deployments should assess exposure and prioritize patching or mitigation. This includes reviewing system logs for suspicious activity, verifying the integrity of web pages, and ensuring that all necessary security patches are applied. Additionally, defenders should educate users about the risks associated with this vulnerability and provide guidance on safe usage.

Why it matters

CVE-2026-96875 is a cross-site scripting vulnerability in Mediawiki - Cargo extension that allows Stored XSS. Defenders should prioritize verification of affected versions and apply patches or mitigations to prevent potential XSS attacks.

• Verification of affected versions is required
• Potential for XSS attacks if not patched
• Defenders should monitor for suspicious activity

Technical summary

The Mediawiki - Cargo extension is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data breaches. Defenders should prioritize verification of affected versions and apply patches or mitigations to prevent potential XSS attacks.

Defensive priority

Defenders should prioritize verification of affected versions and apply patches or mitigations.

Recommended defensive actions

• Verify affected versions of Mediawiki - Cargo extension
• Apply patches or mitigations for vulnerable versions
• Monitor for potential XSS attacks

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The CVE record was published on 2026-09-25T20:17:47.800Z and has not been modified since then. The NVD entry also provides limited information about the vulnerability. Defenders should verify the affected versions and apply patches or mitigations to prevent potential XSS attacks. The vulnerability affects Mediawiki - Cargo extension versions through 3.9.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.