Semantic MediaWiki: Stored cross-site scripting via data-search attributes
Summary
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration for smw-datatable tables. Users with page-edit rights can insert HTML entity-encoded markup in data-search or data-filter cell attributes, which runs script in the browsers of everyone who views the page, including administrators. The attacker needs an account with page-edit rights, and user interaction (viewing the page) is required.
Affected
- Semantic MediaWiki 3.0.0 up to but not including 7.4.1
Fixed in
- Upgrade to Semantic MediaWiki 7.4.1
Workaround
- No vendor-published workaround known.
- Interim risk reduction: restrict page-edit rights to trusted users and manually review existing smw-datatable definitions for data-search or data-filter attributes.
Exploitation
- No evidence of active exploitation known.
- No public proof of concept known.
- Not listed in the CISA Known Exploited Vulnerabilities catalog according to a third-party aggregator (not verified directly).
Our recommendation
- Upgrade Semantic MediaWiki to 7.4.1 in the next regular maintenance window; check MediaWiki core compatibility in the release notes.
- Until patched, restrict page-edit rights to trusted editors and review existing smw-datatable pages.
- Prioritise internet-facing wikis with open registration or external editors.
- Monitor for unexpected script content or changes on wiki pages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126560 www.cve.org
- VulnCheck advisory www.vulncheck.com
- GitHub Security Advisory GHSA-gg2q-rc52-22pp github.com
- Fix commit db7f594 github.com
- Semantic MediaWiki release 7.4.1 github.com
- Vulnerable code in ext.smw.tableprinter.js (7.4.0) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:04.
Original description (NVD)
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes, executing script in viewers' browsers including administrators.
NVD references (5)
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/res/smw/printer/ext.smw.tableprinter.js#L34…
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/db7f59461a7815416a719b71ce48fb76481ecaf2
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-gg2q-rc52-22pp
- https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-data-search-attribu…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.