Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions.
References
| Link | Resource |
|---|---|
| https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-r7xx-9gqh-q8p9 | Exploit Vendor Advisory |
| https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-stored-xss-via-special-browse-keyword-property | Third Party Advisory |
| https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-r7xx-9gqh-q8p9 | Exploit Vendor Advisory |
Configurations
History
04 Nov 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-r7xx-9gqh-q8p9 - Exploit, Vendor Advisory |
03 Nov 2026, 16:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-r7xx-9gqh-q8p9 - Exploit, Vendor Advisory | |
| References | () https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-stored-xss-via-special-browse-keyword-property - Third Party Advisory | |
| CPE | cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:* | |
| First Time |
Semantic-mediawiki semantic Mediawiki
Semantic-mediawiki |
27 Oct 2026, 11:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-27 11:17
Updated : 2026-11-04 17:17
NVD link : CVE-2026-116887
Mitre link : CVE-2026-116887
CVE.ORG link : CVE-2026-116887
JSON object : View
Products Affected
semantic-mediawiki
- semantic_mediawiki
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')