The vulnerability is an improper neutralization of input during web page generation in the MediaWiki Cargo extension, where tab names are stored without proper escaping. This flaw is a CWE‑79 stored cross‑site scripting weakness, allowing an attacker to inject arbitrary JavaScript into the HTML that is rendered for any visitor who views a page that includes the compromised tab. The impact is that any user accessing the affected page could have malicious code executed in their browser session, but it does not grant server‑side code execution or privilege escalation.

The Wikimedia Foundation's MediaWiki systems that include the Cargo extension at version 3.9.4 or earlier are affected. This includes any installation of MediaWiki that has activated the Cargo extension and has not upgraded past the 3.9.4 release.

The CVSS score of 2.3 indicates a low baseline severity for this stored XSS flaw. No EPSS score is available, and it is not listed in the CISA KEV catalog, suggesting limited immediate exploitation traffic. The likely attack path involves an attacker creating or editing a Cargo tab name with a malicious script payload; the payload is stored and rendered for all users who view the page containing that tab. Because the payload runs only in the victim’s browser, there is no escalation to system privileges.