CVE-2026-126564: Semantic MediaWiki 2.5.0 before 7.4.1 Stored XSS via Special:Browse Factbox Title

Q: Who can exploit this issue, and who is exposed to the payload?

An attacker needs page-edit rights and must be able to set a preferred property label containing a malicious payload. Any user who views the affected Special:Browse page or receives the affected output through the smwbrowse API can trigger the stored script, including administrators.

Q: Are deployments affected by default?

The vulnerability requires an authenticated user with page-edit rights to create the malicious preferred property label. The provided information does not establish whether default permissions grant page-edit rights to untrusted users.

Q: What versions should be considered affected?

Semantic MediaWiki versions from 2.5.0 before 7.4.1 are affected. Version 7.4.1 is identified as the fixed release.

Q: How can I determine whether malicious content may already be stored?

Review preferred property labels created or modified by users with page-edit rights, particularly labels containing HTML markup or event-handler attributes such as an img element with an onerror handler. Check content rendered through Special:Browse and the smwbrowse API for unexpected markup.

Published Nov 11, 2026

Updated

Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal   as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API.

Affected Software

1 affected component

Semantic MediaWiki Semantic MediaWiki>=2.5.0<7.4.1

Event History

Nov 11, 2026

CVE Published

via MITRE·02:35 AM

Data Sourced

via MITRE·02:35 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

An attacker needs page-edit rights and must be able to set a preferred property label containing a malicious payload. Any user who views the affected Special:Browse page or receives the affected output through the smwbrowse API can trigger the stored script, including administrators.

Are deployments affected by default?

The vulnerability requires an authenticated user with page-edit rights to create the malicious preferred property label. The provided information does not establish whether default permissions grant page-edit rights to untrusted users.

What versions should be considered affected?

Semantic MediaWiki versions from 2.5.0 before 7.4.1 are affected. Version 7.4.1 is identified as the fixed release.

How can I determine whether malicious content may already be stored?

Review preferred property labels created or modified by users with page-edit rights, particularly labels containing HTML markup or event-handler attributes such as an img element with an onerror handler. Check content rendered through Special:Browse and the smwbrowse API for unexpected markup.

CVE-2026-126564: Semantic MediaWiki 2.5.0 before 7.4.1 Stored XSS via Special:Browse Factbox Title

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Are deployments affected by default?

What versions should be considered affected?

How can I determine whether malicious content may already be stored?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Are deployments affected by default?

What versions should be considered affected?

How can I determine whether malicious content may already be stored?