Live › vulnerability › CVE-2026-116884
Go to dashboardSemanticMediaWiki 5.0.0 through 7.3.0 renders tooltip data-* attributes as raw HTML in ext.smw.tooltip.tippy.js. An editor who plants a crafted .smw-highlighter span can run JavaScript in the browser of any viewer who hovers it, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running SemanticMediaWiki from 5.0.0 before 7.3.1 where people other than trusted editors can edit pages are exposed, because the payload is stored in wiki content and fires for every viewer. Wikis on other versions, or ones with only trusted editors, are lower risk.
No product ranges from the sources yet.
7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.
This page as .md · .json · in your agent: get_signal("CVE-2026-116884")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.