Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-116881

Semantic-mediawiki Semantic Mediawiki: cross-site scripting

Risk score
43/100
CVSS
6.1 v3.1
Exploit chance (30 days)
0.2%
Published
27 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.…
Affected
Semantic-mediawiki Semantic Mediawiki before 7.3.1
Fix
Upgrade Semantic-mediawiki Semantic Mediawiki to 7.3.1 or later.
Exploitation
Public proof of concept

Story map

Story map: Semantic-mediawiki Semantic MediawikiTHE FLAWSTHE FIXCVE-2026-116881Cross-site scriptingCVSS 6.1 · EPSS 0%CVE-2026-116890Missing authorisationCVSS 7.3 · EPSS 0%CVE-2026-116878Denial of serviceCVSS 7.5 · EPSS 0%CVE-2026-116871Semantic MediaWiki 3.0.0before 7.3.1 contains anuncontrolled recursion…CVSS 7.5 · EPSS 0%Upgrade…7.3.1 · 7.3.0or later on your release lineWho is exposedSemantic-mediawiki SemanticMediawiki before 7.3.0AMBER · PATCH THIS WEEKSemantic-mediawiki Semantic…Semantic MediaWiki from 3.0.0before 7.3.0 contains a missingauthorization vulnerability in theapi.php smwtask module thatallows unauthenticatedattackers to run admin-onlymaintenance tasks. Attackers…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCross-site scripting (CWE-79)400 other warnings in 30 days →Same productEarlier Semantic-mediawiki Semantic Mediawikiwarnings18 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Semantic-mediawiki Semantic Mediawiki: Amber, patch this week. Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer,…

The flaws

  • CVE-2026-116881: Cross-site scripting (CVSS 6.1 · EPSS 0%)
  • CVE-2026-116890: Missing authorisation (CVSS 7.3 · EPSS 0%)
  • CVE-2026-116878: Denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-116871: Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in… (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Semantic-mediawiki Semantic Mediawiki: 7.3.1 · 7.3.0 or later on your release line

Who is exposed: Semantic-mediawiki Semantic Mediawiki before 7.3.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.1 medium
  • Public exploit or proof of concept referenced

References

Original description

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.

Last activity 27 Oct 2026. Patch Forecast updates every hour.