CVE-2026-116886

The record

Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.

Affected packages

Related vulnerabilities

• CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. CWE-79
• CVE-2026-117645 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')… CWE-79
• CVE-2026-94175 Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. CWE-79
• CVE-2026-7004 WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site… CWE-79
• CVE-2026-54855 Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. CWE-79
• CVE-2026-48201 Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. CWE-79
• CVE-2026-39739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')… CWE-79
• CVE-2026-39786 Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. CWE-79