Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-116881Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete

Medium 6.1

In plain English

A medium-severity cross-site scripting in SemanticMediaWiki from SemanticMediaWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 94.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.

Affected products (as reported)

Vendor	Product	Versions
SemanticMediaWiki	SemanticMediaWiki	3.0.0 – before 7.3.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-mvpf-4wj8-2hwf) vendor-advisory
VulnCheck Advisory: Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete third-party-advisory