Vulnerability Description
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Semantic-Mediawiki | Semantic Mediawiki | >= 5.0.0, < 7.3.1 |
Related Weaknesses (CWE)
References
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-ExploitMitigationVendor Advisory
- https://www.vulncheck.com/advisories/semanticmediawiki-5.0.0-before-7.3.1-storedThird Party Advisory
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-116884?
CVE-2026-116884 is a vulnerability with a CVSS score of 6.1 (MEDIUM). SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors ...
How severe is CVE-2026-116884?
CVE-2026-116884 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116884?
Check the references section above for vendor advisories and patch information. Affected products include: Semantic-Mediawiki Semantic Mediawiki.