CVE-2026-116884: SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SemanticMediaWikito a version that resolves this vulnerability.Fixed in 7.3.1
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
An editor who can add the affected .smw-highlighter span and its tooltip data-* attributes can store a malicious payload. It executes when another user hovers the element, including when that user is an administrator.
What user interaction is required for exploitation?
A viewer must hover the crafted highlighter element. No attacker authentication is described, but the attacker must be able to plant the malicious content through editing.
Which installations are affected?
SemanticMediaWiki versions from 5.0.0 before 7.3.1 are affected. The vulnerable behavior is in the ext.smw.tooltip.tippy.js tooltip module, which renders specified data-* attributes using innerHTML with allowHTML enabled.