Improper neutralization of user input during web page generation in the MediaWiki Cargo extension leads to reflected cross‑site scripting. Malicious payloads entered into the Cargo full‑text search can be reflected back to the browser where they execute as JavaScript, allowing attackers to hijack user sessions, deface pages, or run arbitrary code in the victim’s context. This flaw is identified as CWE‑79.

The vulnerability affects the Cargo extension of MediaWiki, through version 3.9.4. Any installation of MediaWiki that includes Cargo 3.9.4 or earlier is vulnerable.

The CVSS score of 6.9 reflects moderate severity, and the vulnerability can be triggered without authentication via a crafted search query accessed through the web interface. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers with access to the public search endpoint can inject malicious scripts that execute in the context of users visiting the resulting page; the exploit is straightforward once the target environment is known.