vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-116883

Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions

MEDIUM
4.8
CVSS Score
Published: October 27, 2026 at 10:23 AM UTC
Updated: October 27, 2026 at 03:06 PM UTC
1 product affected across 1 vendorSemantic MediaWiki

Using SemanticMediaWiki by SemanticMediaWiki?

Get instant alerts when new vulnerabilities affect SemanticMediaWiki - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.8
Exploit prediction
EPSS 0.1%

Description

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in HtmlBuilder, altering pages and targeting users who view the schema.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Semantic MediaWiki· Semantic Mediawikimediawiki
90%
3.1.0
Vendor states this is fixed in 7.3.1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

Vendor Advisory
Source: cverecord
https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-2xr9-cr6h-wr6m
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/semantic-mediawiki-3.1.0-before-7.3.1-stored-xss-via-schema-descriptions

CVSS

4.8MEDIUMVulnCheck
Vector?

Quick Info

StatusUNDERGOING ANALYSIS
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card