{"id":"CVE-2026-116884","kind":"vulnerability","aliases":["CVE-2026-116884"],"related":[],"title":"SemanticMediaWiki: stored XSS via tooltip data attributes runs script on hover","description":"SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.","summary":"SemanticMediaWiki 5.0.0 through 7.3.0 renders tooltip data-* attributes as raw HTML in ext.smw.tooltip.tippy.js. An editor who plants a crafted .smw-highlighter span can run JavaScript in the browser of any viewer who hovers it, including administrators.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["trusted-editors-only","version-7.3.1-or-later"],"how_to_check":"- Look at the installed SemanticMediaWiki version in Special:Version on the wiki, or in the extension's composer.json or extension.json.\n- Confirm whether the wiki allows untrusted users to edit pages, since the attacker must be an editor.","fix":"- Upgrade SemanticMediaWiki to `7.3.1` or later.\n- Until upgraded, restrict editing rights to trusted users.","status":"open","published_at":"2026-10-27T11:17:30+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:32:02+00:00","updated_at":"2026-10-27T11:32:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T11:32:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SemanticMediaWiki to `7.3.1` or later.\n- Until upgraded, restrict editing rights to trusted users.","reach":"internet","title":"SemanticMediaWiki: stored XSS via tooltip data attributes runs script on hover","impact":"medium","summary":"SemanticMediaWiki 5.0.0 through 7.3.0 renders tooltip data-* attributes as raw HTML in ext.smw.tooltip.tippy.js. An editor who plants a crafted .smw-highlighter span can run JavaScript in the browser of any viewer who hovers it, including administrators.","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs JavaScript in administrator browsers via stored tooltip.","analyst_note":"","how_to_check":"- Look at the installed SemanticMediaWiki version in Special:Version on the wiki, or in the extension's composer.json or extension.json.\n- Confirm whether the wiki allows untrusted users to edit pages, since the attacker must be an editor.","needs_analyst":false,"not_affected_if":["version-7.3.1-or-later","trusted-editors-only"],"who_is_affected":"Wikis running SemanticMediaWiki from 5.0.0 before 7.3.1 where people other than trusted editors can edit pages are exposed, because the payload is stored in wiki content and fires for every viewer. Wikis on other versions, or ones with only trusted editors, are lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3379,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116884':14A,17A '-2026':13A,16A '5.0.0':27B,65C '7.3.0':29B '7.3.1':67C 'administr':62B,121C 'allowhtml':85C 'attribut':7A,33B,81C,114C 'bottom':109C 'browser':54B 'contain':68C 'content':100C 'craft':44B 'cross':72C 'cross-sit':71C 'cve':12A,15A 'data':6A,32B,80C,99C,102C,105C,108C,112C 'data-bottom':107C 'data-cont':98C 'data-them':111C 'data-titl':101C 'data-top':104C 'editor':40B,87C 'enabl':86C 'execut':116C 'ext.smw.tooltip.tippy.js':38B,77C 'highlight':47B,93C 'host':22B 'hover':11A,59B,122C 'html':36B 'includ':61B,120C 'innerhtml':83C 'javascript':51B,117C 'malici':97C 'mediawiki':18B,25B 'packag':19B 'plant':42B,89C 'raw':35B 'render':30B,79C 'run':8A,50B 'script':9A,74C 'self':21B 'self-host':20B 'semant':24B 'semantic-mediawiki':23B 'semanticmediawiki':1A,26B,63C 'site':73C 'smw':46B,92C 'smw-highlight':45B,91C 'span':48B,94C 'store':2A,70C 'theme':113C 'titl':103C 'tooltip':5A,31B 'top':106C 'via':4A,82C 'viewer':57B,119C 'vulner':75C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Wikis running SemanticMediaWiki from 5.0.0 before 7.3.1 where people other than trusted editors can edit pages are exposed, because the payload is stored in wiki content and fires for every viewer. Wikis on other versions, or ones with only trusted editors, are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116884","severity":null,"published_at":"2026-10-27T11:17:30+00:00","modified_at":"2026-10-27T11:17:30+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}