CVE-2026-126559: Semantic MediaWiki 4.2.0 before 7.4.1 Stored XSS via Special:FacetedSearch

Q: Who can exploit this issue, and who is exposed to the injected script?

An attacker needs the smw-schemaedit right to save malicious FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels. The stored script executes when users visit Special:FacetedSearch, including administrators.

Q: Which versions are affected?

Semantic MediaWiki versions from 4.2.0 before 7.4.1 are affected. Version 7.4.1 is identified as the fixed release.

Q: What should be checked to identify possible compromise?

Review FACETEDSEARCH_PROFILE_SCHEMA profile keys and labels for markup intended to escape HTML option elements or execute scripts. Pay particular attention to profiles created or modified by accounts granted the smw-schemaedit right.

Published Nov 11, 2026

Updated

Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCHPROFILESCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators.

Affected Software

1 affected component

Semantic MediaWiki Semantic MediaWiki>=4.2.0<7.4.1

Event History

Nov 11, 2026

CVE Published

via MITRE·02:35 AM

Data Sourced

via MITRE·02:35 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the injected script?

An attacker needs the smw-schemaedit right to save malicious FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels. The stored script executes when users visit Special:FacetedSearch, including administrators.

Which versions are affected?

Semantic MediaWiki versions from 4.2.0 before 7.4.1 are affected. Version 7.4.1 is identified as the fixed release.

What should be checked to identify possible compromise?

Review FACETEDSEARCH_PROFILE_SCHEMA profile keys and labels for markup intended to escape HTML option elements or execute scripts. Pay particular attention to profiles created or modified by accounts granted the smw-schemaedit right.

CVE-2026-126559: Semantic MediaWiki 4.2.0 before 7.4.1 Stored XSS via Special:FacetedSearch

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the injected script?

Which versions are affected?

What should be checked to identify possible compromise?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the injected script?

Which versions are affected?

What should be checked to identify possible compromise?