Stored Cross-Site Scripting Vulnerability in SemanticMediaWiki by Semantic MediaWiki
CVE-2026-116889

5.3MEDIUM

Key Information:

Vendor

Semanticmediawiki

Status
Semanticmediawiki
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116889?

SemanticMediaWiki versions before 7.3.1, specifically from 2.5.0, are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability enables users with page-edit rights to inject malicious scripts through Code-typed property values. Attackers can craft valid JSON values that contain HTML markup. When rendered by the CodeStringValueFormatter on Special:Browse, the markup is not properly escaped, allowing the execution of arbitrary JavaScript within the users' sessions. This can lead to various security risks including data theft or unauthorized actions on behalf of the user.

Affected Version(s)

SemanticMediaWiki 2.5.0 < 7.3.1

SemanticMediaWiki 7.3.1

References

https://github.com/SemanticMediaWiki/SemanticMediaWiki/se...
vendor-advisory
https://www.vulncheck.com/advisories/semanticmediawiki-2....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.