← Database

CVE-2026-126559

MEDIUM CVSS: 4.8 Published: 2026-11-11 Modified: 2026-11-11

Description

Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators.

Affected Platforms

Unknown

Weakness Type

CWE-79

References