Stored Cross-Site Scripting in Semantic MediaWiki by Semantic MediaWiki

CVE-2026-126559

What is CVE-2026-126559?

A stored cross-site scripting vulnerability exists in Semantic MediaWiki versions prior to 7.4.1, specifically in the OptionsBuilder::profiles() function. This flaw allows users with smw-schemaedit rights to inject malicious markup. Consequently, an attacker can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that can break out of option elements, potentially executing scripts for every visitor of Special:FacetedSearch, including administrators. It’s crucial for users and administrators to apply the latest updates to mitigate the risks associated with this vulnerability.

References