Stored Cross-Site Scripting in Semantic MediaWiki by Semantic MediaWiki

CVE-2026-126567

What is CVE-2026-126567?

Semantic MediaWiki versions prior to 7.4.1 are vulnerable to a stored cross-site scripting attack via the Special:Ask feature when using the ElasticStore backend. Users with edit rights can exploit this vulnerability by injecting malicious scripts through unescaped outputs in the native_result and score_set properties. By crafting a misleading link to Special:Ask, attackers can trick administrators and other authorized users into executing the injected script within their session, potentially leading to unauthorized access or data manipulation.

References