XSS Vulnerability in MediaWiki's EmbedVideo Extension by StarCitizenWiki
CVE-2026-55692
7.5HIGH
What is CVE-2026-55692?
The EmbedVideo Extension for MediaWiki, prior to version 4.1.0, is vulnerable to Cross-Site Scripting (XSS) due to improper handling of JSON data returned through certain functions. Specifically, the extension fails to safely escape single quotes, allowing attackers to inject malicious event handlers via crafted archiveorg identifiers and URLs accepted by the extension's validators. A malicious user with edit rights can exploit this vulnerability to execute harmful JavaScript when a wiki page is rendered by unsuspecting visitors. This vulnerability has been addressed in version 4.1.0, which implements necessary security measures to mitigate the risks associated with this flaw.
Affected Version(s)
mediawiki-extensions-EmbedVideo < 4.1.0