CVE-2026-116884
Received Received - Intake

Stored XSS in SemanticMediaWiki via Data Attributes

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116884
EUVD
EUVD-2026-110712

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SemanticMediaWiki SemanticMediaWiki 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in SemanticMediaWiki versions 5.0.0 through 7.3.0. Editors can inject malicious data-* attributes into a .smw-highlighter span. When users hover over the element, arbitrary JavaScript executes in their browser.

Detection Guidance

Check SemanticMediaWiki versions between 5.0.0 and 7.3.0 for the presence of the vulnerable ext.smw.tooltip.tippy.js file. Inspect tooltip modules for .smw-highlighter spans with data-* attributes like data-content, data-title, data-top, data-bottom, or data-theme that may contain executable JavaScript payloads.

Impact Analysis

Attackers can steal session tokens, perform CSRF attacks, access authenticated APIs, or deface pages. Even administrators are at risk when viewing affected pages. The impact depends on user privileges and actions taken via the executed JavaScript.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy). Organizations may face compliance breaches if user data is compromised through this XSS flaw.

Mitigation Strategies

Upgrade SemanticMediaWiki to version 7.3.1 or later to patch the vulnerability. Alternatively, disable allowHTML in the tooltip module or sanitize data-* attribute values before rendering to prevent JavaScript execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116884. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart