Improper neutralization of input during web page generation allows an attacker to inject malicious scripts that will be rendered in the browser of anyone who views a affected page. The plot may result in defacement, cookie theft, or session hijacking. This flaw is a classic cross‑site scripting issue (CWE‑79).

The vulnerability affects the Mediawiki Cargo extension supplied by the Wikimedia Foundation, for all releases through version 3.9.4. Sites that use these versions of the extension are potentially exposed.

The assigned CVSS score of 6.9 indicates a moderate severity. As no EPSS score is available and the flaw is not listed in the CISA KEV catalog, the current exploitation probability appears low. However, the flaw can be triggered via the web interface where an attacker supplies a crafted field alias; any visitors to the resulting page would then be exposed to the injected script.