CVE-2026-126559
Semantic MediaWiki 4.2.0 before 7.4.1 Stored XSS via Special:FacetedSearch
Description
Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators.
INFO
Published Date :
Nov. 11, 2026, 2:35 a.m.
Last Modified :
Nov. 11, 2026, 2:35 a.m.
Remotely Exploit :
Yes !
Source :
VulnCheck
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE | ||||
| CVSS 4.0 | MEDIUM | 83251b91-4cc7-4094-a5c7-464a1b83ea10 |
Solution
- Update Semantic MediaWiki to version 7.4.1 or later.
- Review and sanitize user-provided profile keys and labels.
- Restrict smw-schemaedit right to trusted users.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-126559 vulnerability anywhere in the article.