A stored cross‑site scripting vulnerability exists in the Cargo extension for MediaWiki. The flaw arises from inadequate neutralization of script‑related HTML tags in the dynamic table format, allowing an attacker to embed malicious JavaScript that is later rendered in a wiki page. Exploited malicious code executes in the victim’s browser, potentially enabling credential theft, defacement, or redirection.

This issue affects the Wikimedia Foundation’s MediaWiki Cargo Extension, versions older than 3.8.7. The vulnerable component is the dynamic table feature where data entered by users is displayed without proper filtering. No other mediawiki components were identified as affected in the advisory.

The CVSS base score is 6.3, indicating moderate risk. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can inject malicious scripts via the dynamic table entries, which are then displayed to all users who view the page. The flaw resides on the client side, so no privileged access is required to exploit. The lack of a public exploit and moderate score suggest the risk is present but moderate, making timely patching prudent.