Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-116875

Semantic-mediawiki Semantic Mediawiki: cross-site scripting

Risk score
42/100
CVSS
6.1 v3.1
Published
27 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Speci…
Affected
Semantic-mediawiki Semantic Mediawiki before 7.3.1
Fix
Upgrade Semantic-mediawiki Semantic Mediawiki to 7.3.1 or later.
Exploitation
Public proof of concept

Story map

Story map: Semantic-mediawiki Semantic MediawikiTHE FLAWSTHE FIXCVE-2026-116875Cross-site scriptingCVSS 6.1CVE-2026-116874Cross-site scriptingCVSS 6.1CVE-2026-116884Cross-site scriptingCVSS 6.1CVE-2026-116889Cross-site scriptingCVSS 6.1Upgrade…7.3.1or later on your release lineWho is exposedSemantic-mediawiki SemanticMediawiki before 7.3.1YELLOW · PLAN IT INSemantic-mediawiki Semantic…SemanticMediaWiki from 3.0.0before 7.3.1 contains a reflectedcross-site scriptingvulnerability in Special:Ask,which outputs separatorparameters (sep, propsep,valuesep, delim, separator)…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCross-site scripting (CWE-79)396 other warnings in 30 days →Same productEarlier Semantic-mediawiki Semantic Mediawikiwarnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Semantic-mediawiki Semantic Mediawiki: Yellow, plan it in. SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Speci…

The flaws

The fix

Upgrade Semantic-mediawiki Semantic Mediawiki: 7.3.1 or later on your release line

Who is exposed: Semantic-mediawiki Semantic Mediawiki before 7.3.1

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.1 medium
  • Public exploit or proof of concept referenced

References

Original description

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens.

Last activity 27 Oct 2026. Patch Forecast updates every hour.