The Cargo Extension in MediaWiki does not neutralize script‑related HTML tags that can be entered into list fields. When a malicious user saves such content, the script tags are rendered in Cargo pages and the Special:CargoTables view. The injected code executes in the browsers of any visitors to those pages, allowing session hijacking, credential theft or other client‑side attacks. This weakness is a classic cross‑site scripting flaw, matching CWE‑79 and CWE‑80.

All installations of the MediaWiki Cargo Extension that are older than version 3.8.7 are affected. The issue manifests when list fields are populated with unsanitized user input and the resulting values are displayed on Cargo pages or the special table view. Every user who can view those pages is potentially exposed to the risk.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, implying limited exploitation activity to date. Attackers can exploit the flaw by creating or editing Cargo entries containing malicious script tags through normal web requests; any subsequent viewing of the affected pages will trigger the injected code, making the vulnerability fully stored and easily repeatable.