CVE-2026-126560: Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via data-search Attributes

Q: Who can exploit this issue, and who is at risk?

An attacker needs page-edit rights and must be able to create or modify an author-written smw-datatable table. Any user who views the affected page can be exposed, including administrators.

Q: What input is used to trigger the cross-site scripting?

The attacker places HTML entity-encoded markup in data-search or data-filter cell attributes. The DataTables integration initializes the author-written table without changing that content, allowing script to execute in a viewer's browser.

Q: Which versions are affected?

Semantic MediaWiki versions from 3.0.0 up to, but not including, 7.4.1 are affected. Version 7.4.1 is identified as the fixed release.

Published Nov 11, 2026

Updated

Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes, executing script in viewers' browsers including administrators.

Affected Software

1 affected component

Semantic MediaWiki Semantic MediaWiki>=3.0.0<7.4.1

Event History

Nov 11, 2026

CVE Published

via MITRE·02:35 AM

Data Sourced

via MITRE·02:35 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is at risk?

An attacker needs page-edit rights and must be able to create or modify an author-written smw-datatable table. Any user who views the affected page can be exposed, including administrators.

What input is used to trigger the cross-site scripting?

The attacker places HTML entity-encoded markup in data-search or data-filter cell attributes. The DataTables integration initializes the author-written table without changing that content, allowing script to execute in a viewer's browser.

Which versions are affected?

Semantic MediaWiki versions from 3.0.0 up to, but not including, 7.4.1 are affected. Version 7.4.1 is identified as the fixed release.

CVE-2026-126560: Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via data-search Attributes

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is at risk?

What input is used to trigger the cross-site scripting?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is at risk?

What input is used to trigger the cross-site scripting?

Which versions are affected?