CVE-2026-116882
CVE-2026-116882 · Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.
CVSS 4.8 · Medium · Fix available
- Published
- Updated
Affected products and versions
semanticmediawiki
- Versions
- ≥ 4.2.0, < 7.3.1: Affected (semver)
- 7.3.1: Not affected (semver)
Update to 7.3.1