Medium severity4.8NVD Advisory· Published Oct 27, 2026

CVE-2026-116882

Description

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Semantic Mediawiki/Semantic Mediawikillm-fuzzy
Range: 4.2.0 <= 7.3.1

Patches

Vulnerability mechanics

References

github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-3r5m-693w-jm33nvd
www.vulncheck.com/advisories/semantic-mediawiki-4.2.0-before-7.3.1-stored-xss-via-facetedsearch-exploration-labelsnvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000