CERT24CVE-2026-116888 — SemanticMediaWiki 3.2.0 before 7.3.1: Stored XSS via Special:Browse Group HeadingLoading data…
CERT24Threat Observatory
Period

CVE-2026-116888 — SemanticMediaWiki 3.2.0 before 7.3.1: Stored XSS via Special:Browse Group Heading

SemanticMediaWiki versions from 3.2.0 before 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. Users with the smw-schemaedit right can inject script markup through the property group schema canonical_name, which is rendered unescaped in Special:Browse headings.

← Back to intelligence

CVE-2026-116888 — SemanticMediaWiki 3.2.0 before 7.3.1: Stored XSS via Special:Browse Group Heading

SemanticMediaWiki versions from 3.2.0 before 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. Users with the smw-schemaedit right can inject script markup through the property group schema canonical_name, which is rendered unescaped in Special:Browse headings.