Semantic MediaWiki, Reflected XSS, CVE-2025-61682 (Moderate) -DC-Sep2026-2476

The vulnerability resides in the `Special:Ask` page of the Semantic MediaWiki extension, specifically when the `headers` parameter is set to plain. The `TableResultPrinter` class fails to apply output-context escaping before passing the header value to the table renderer. Consequently, user-controlled `mainlabel` or property label content is emitted directly into `

` elements via a raw HTML path, allowing an attacker to inject arbitrary JavaScript. This is a classic reflected cross-site scripting (XSS) issue (CWE-79) where the malicious payload is embedded in a crafted URL and executed in the victim’s browser upon visiting the link. The attack requires user interaction, as the victim must click a specially crafted link containing the payload. Successful exploitation enables session cookie theft, credential harvesting, or performing actions on behalf of the authenticated user. The fix, introduced in later releases, ensures that the header value is treated as display data and sanitized at the sink before final HTML emission, which is the correct layer because the renderer owns the final output context.

DailyCVE Form:

Platform: Semantic MediaWiki
Version: 7.2.0
Vulnerability : Reflected XSS
Severity: Moderate
date: 2026-07-18

Prediction: 2026-08-18

What Undercode Say:

Identify the vulnerable endpoint
curl -s "https://target-wiki/index.php/Special:Ask?eq=yes&p[bash]=table&p[bash]=plain&p[bash]=<script>alert(document.cookie)</script>"

<!-- Injected payload appears in the <th> element -->
<th><script>alert(document.cookie)</script></th>

Exploit: (Educational Purposes!)

https://target-wiki/index.php/Special:Ask?eq=yes&p[bash]=table&p[bash]=plain&p[bash]=<img src=x onerror=alert(1)>

Protection: from this CVE

Upgrade to Semantic MediaWiki 7.2.1 or later, where the `TableResultPrinter` applies proper output-context escaping. As a temporary mitigation, avoid clicking untrusted links to `Special:Ask` pages and consider implementing a strict Content Security Policy (CSP) header.

Impact:

An attacker can execute arbitrary JavaScript in the context of a victim’s authenticated session, leading to session hijacking, sensitive data exfiltration, or unauthorized actions performed on behalf of the user.

🎯Let’s Practice Exploiting & Learn Patching For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin

Listen to this Post