CVE-2025-10354: Reflected Cross-Site Scripting (XSS) in Semantic MediaWiki

Published Apr 21, 2026

Updated

Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

Affected Software

1 affected component

Semantic MediaWiki Semantic MediaWiki

Remediation

Information

The vulnerability has been fixed by the Semantic MediaWiki team in version 5.0.2.

Event History

Apr 21, 2026

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-10354?

CVE-2025-10354 is classified as a High severity vulnerability due to its potential to allow attackers to execute arbitrary JavaScript in users' browsers.

How do I fix CVE-2025-10354?

To fix CVE-2025-10354, update Semantic MediaWiki to the latest version that includes patches for this reflected XSS vulnerability.

What impact does CVE-2025-10354 have on users?

CVE-2025-10354 can lead to data theft, session hijacking, or defacement of the affected Semantic MediaWiki site.

How can attackers exploit CVE-2025-10354?

Attackers can exploit CVE-2025-10354 by crafting malicious URLs that, when clicked by a user, execute harmful JavaScript on their browser.

Are there any known workarounds for CVE-2025-10354?

As of now, the best workaround for CVE-2025-10354 is to restrict user access to the vulnerable pages until a patch is applied.