XSS Vulnerability in Semantic MediaWiki Affects User Queries
CVE-2026-77606

6.1MEDIUM

Key Information:

Vendor

Semanticmediawiki

Status
Semanticmediawiki
Vendor
CVE Published:
18 September 2026

What is CVE-2026-77606?

Semantic MediaWiki, an open-source extension for MediaWiki, allowed user-controlled content to be rendered as executable HTML in table headers when using the headers=plain option. This issue, which existed in versions prior to 7.2.0, could enable attackers to inject malicious scripts into pages, posing a significant risk to user safety and data integrity. Users are encouraged to upgrade to version 7.2.0 or later to mitigate this risk.

Affected Version(s)

SemanticMediaWiki < 7.2.0

References

https://github.com/SemanticMediaWiki/SemanticMediaWiki/se...
x_refsource_CONFIRM
https://github.com/SemanticMediaWiki/SemanticMediaWiki/re...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.