CVE-2026-116887: Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions.
Affected Software
Event History
Frequently Asked Questions
Who can introduce the malicious content?
An attacker needs page-edit rights. They can place an event-handler payload in a Keyword-typed property value.
Which users are at risk when the payload is viewed?
Users who view the affected content through Special:Browse can have JavaScript executed in their session. This includes administrators, whose tokens may be read and whose session may be used to perform actions.
How can I determine whether my deployment is in the affected version range?
The affected range is Semantic MediaWiki 3.0.0 up to, but not including, 7.3.1.
Does exploitation require interaction from another user?
Yes. The payload executes when a viewer renders the unescaped Keyword property value on Special:Browse.