CVE-2026-55692
Received Received - Intake

Stored XSS in MediaWiki EmbedVideo Extension

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs accepted by the affected service validators can cause getUrl() output to terminate the attribute and inject event-handler attributes into the generated figure element. A user able to edit a wiki page can store JavaScript that executes in the wiki origin when visitors render the page. This issue is fixed in version 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55692
EUVD
EUVD-2026-78829

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mediawiki embedvideo_extension 4.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55692 is a Stored Cross-Site Scripting (XSS) vulnerability in the MediaWiki EmbedVideo extension. It occurs when the default $wgEmbedVideoRequireConsent setting is enabled. Attackers can inject malicious JavaScript by providing a malformed video URL or ID containing a single quote. This escapes the JSON structure in the data-mw-iframeconfig attribute and adds event handlers like onmouseover. The injected script executes automatically for all page visitors without requiring interaction.

Detection Guidance

To detect this vulnerability, check the version of the EmbedVideo extension installed on your MediaWiki system. If it is version 4.0.0 or lower, the system is vulnerable. Use commands like 'composer show mediawiki/embedvideo' or inspect the extension directory for version information.

Impact Analysis

An attacker who can edit a wiki page can store malicious JavaScript that executes in the wiki's origin when visitors view the page. This could lead to theft of session cookies, account hijacking, or defacement of the wiki. The attack requires no special privileges and works over the network, affecting all visitors to compromised pages.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized script execution that may access or exfiltrate user data without consent. For HIPAA, it risks exposing protected health information if the wiki handles such data. Compliance may be impacted due to insufficient protection against cross-site scripting attacks.

Mitigation Strategies

Immediately update the EmbedVideo extension to version 4.1.0 or later. This can be done via Composer with 'composer require mediawiki/embedvideo ~4.1.0'. Alternatively, apply the patch from commit 370156335b325bb81d14d89edf0a1f2643d50a84 if upgrading is not feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55692. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart