CVE-2026-116884Medium· 6.1▾ SunlitSemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span wit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.
SemanticMediaWiki >= 5.0.0 < 7.3.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116874Medium· 6.1SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter
CVE-2026-116882Medium· 4.8Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
CVE-2026-116886Medium· 5.4Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse
CVE-2026-116891Medium· 6.1SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate
CVE-2026-116892Medium· 6.1SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile
CVE-2026-116883Medium· 4.8Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions