{"id":"CVE-2026-126560","kind":"vulnerability","aliases":["CVE-2026-126560"],"related":[],"title":"Semantic MediaWiki: stored XSS via DataTables tables runs script in viewers' browsers","description":"Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes, executing script in viewers' browsers including administrators.","summary":"Semantic MediaWiki's DataTables integration renders author-written smw-datatable cell attributes without sanitising them. A user with page-edit rights can store markup that runs script in the browser of anyone who views the page, including administrators.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["no-smw-datatable-tables","versions-7.4.1-or-later"],"how_to_check":"- Find the installed version of Semantic MediaWiki in the wiki's `Special:Version` page or `composer.json`/`LocalSettings.php` setup.\n- Check whether any page uses the `smw-datatable` class, with `data-search` or `data-filter` attributes.","fix":"- Semantic MediaWiki: upgrade to `7.4.1` or later (the fix version for this CVE per the NVD range: before 7.4.1).","status":"open","published_at":"2026-11-11T03:16:49+00:00","first_seen_at":"2026-11-11T03:24:59+00:00","triaged_at":"2026-11-11T03:26:31+00:00","updated_at":"2026-11-11T03:26:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T03:26:31Z","model":"claude-haiku-5-5","output":{"fix":"- Semantic MediaWiki: upgrade to `7.4.1` or later (the fix version for this CVE per the NVD range: before 7.4.1).","reach":"internet","title":"Semantic MediaWiki: stored XSS via DataTables tables runs script in viewers' browsers","impact":"medium","summary":"Semantic MediaWiki's DataTables integration renders author-written smw-datatable cell attributes without sanitising them. A user with page-edit rights can store markup that runs script in the browser of anyone who views the page, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in viewers' browsers, including administrators, enabling session hijacking.","analyst_note":"","how_to_check":"- Find the installed version of Semantic MediaWiki in the wiki's `Special:Version` page or `composer.json`/`LocalSettings.php` setup.\n- Check whether any page uses the `smw-datatable` class, with `data-search` or `data-filter` attributes.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-smw-datatable-tables","versions-7.4.1-or-later"],"who_is_affected":"Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.4.1 that use the DataTables integration (smw-datatable tables). Exposure needs a user with page-edit rights to write the payload, and the script then runs for any viewer, so wikis open to many editors carry more risk. Wikis that do not use smw-datatable tables are not exposed through this path.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000783,"input_tokens":4654,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126560':15A,18A '-2026':14A,17A '3.0.0':70C '7.4.1':72C 'add':102C 'administr':67B,124C 'anyon':61B 'attribut':40B,117C 'author':34B,88C 'author-written':33B,87C 'browser':12A,59B,122C 'cell':39B,116C 'contain':73C 'cross':77C 'cross-sit':76C 'cve':13A,16A 'data':110C,114C 'data-filt':113C 'data-search':109C 'datat':6A,30B,38B,83C,92C 'edit':49B,99C 'encod':106C 'entiti':105C 'entity-encod':104C 'execut':118C 'filter':115C 'host':23B 'html':103C 'includ':66B,123C 'initialis':86C 'integr':31B,84C 'markup':53B,107C 'mediawiki':2A,19B,26B,28B,69C 'packag':20B 'page':48B,65B,98C 'page-edit':47B,97C 'render':32B 'right':50B,100C 'run':8A,55B 'sanitis':42B 'script':9A,56B,79C,119C 'search':111C 'self':22B 'self-host':21B 'semant':1A,25B,27B,68C 'semantic-mediawiki':24B 'site':78C 'smw':37B,91C 'smw-datat':36B,90C 'store':3A,52B,75C 'tabl':7A,93C 'unchang':94C 'user':45B,95C 'via':5A 'view':63B 'viewer':11A,121C 'vulner':80C 'without':41B 'written':35B,89C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.4.1 that use the DataTables integration (smw-datatable tables). Exposure needs a user with page-edit rights to write the payload, and the script then runs for any viewer, so wikis open to many editors carry more risk. Wikis that do not use smw-datatable tables are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mediawiki","medium","package","selfhosted","semanticmediawiki"],"campaign_type":null,"search_a":"'-126560':15A,18A '-2026':14A,17A 'browser':12A 'cve':13A,16A 'datat':6A 'mediawiki':2A 'run':8A 'script':9A 'semant':1A 'store':3A 'tabl':7A 'via':5A 'viewer':11A 'xss':4A","search_b":"'administr':67B 'anyon':61B 'attribut':40B 'author':34B 'author-written':33B 'browser':59B 'cell':39B 'datat':30B,38B 'edit':49B 'host':23B 'includ':66B 'integr':31B 'markup':53B 'mediawiki':19B,26B,28B 'packag':20B 'page':48B,65B 'page-edit':47B 'render':32B 'right':50B 'run':55B 'sanitis':42B 'script':56B 'self':22B 'self-host':21B 'semant':25B,27B 'semantic-mediawiki':24B 'smw':37B 'smw-datat':36B 'store':52B 'user':45B 'view':63B 'without':41B 'written':35B","search_c":"'3.0.0':70C '7.4.1':72C 'add':102C 'administr':124C 'attribut':117C 'author':88C 'author-written':87C 'browser':122C 'cell':116C 'contain':73C 'cross':77C 'cross-sit':76C 'data':110C,114C 'data-filt':113C 'data-search':109C 'datat':83C,92C 'edit':99C 'encod':106C 'entiti':105C 'entity-encod':104C 'execut':118C 'filter':115C 'html':103C 'includ':123C 'initialis':86C 'integr':84C 'markup':107C 'mediawiki':69C 'page':98C 'page-edit':97C 'right':100C 'script':79C,119C 'search':111C 'semant':68C 'site':78C 'smw':91C 'smw-datat':90C 'store':75C 'tabl':93C 'unchang':94C 'user':95C 'viewer':121C 'vulner':80C 'written':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T23:29:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126560","severity":null,"published_at":"2026-11-11T03:16:49+00:00","modified_at":"2026-11-11T03:16:49+00:00","first_seen_at":"2026-11-11T03:24:59+00:00","fetched_at":"2026-11-11T03:24:59+00:00","note":null}],"documents":[{"id":122018,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/db7f59461a7815416a719b71ce48fb76481ecaf2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122015,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122020,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-gg2q-rc52-22pp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T23:29:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122021,"url":"https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-data-search-attributes","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}