The vulnerability arises from an improper neutralization of script‑related HTML tags when URLs are embedded in the Cargo Extension’s map format. As a result, malicious JavaScript can be stored and rendered to users who view the affected page. This allows an attacker to execute code in the context of the site, potentially compromising user data and site integrity.

MediaWiki Cargo Extension versions prior to 3.8.7 are affected. Sites running these older releases are at risk if Cargo data can be edited or submitted by users.

The CVSS score of 6.3 reflects moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker who can submit or modify Cargo data, causing the stored XSS payload to be displayed to other users.