Product
The Cargo extension for MediaWiki is vulnerable to reflected XSS via unescaped field-alias text in export error messages, allowing unauthenticated attackers to execute arbitrary scripts in the wiki's origin.