Log in / Sign up

Vulnerability details

CVE-2026-55692

StarCitizenWiki mediawiki-extensions-EmbedVideo

EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

CVSS 3.1
7.5High

Official description

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs accepted by the affected service validators can cause getUrl() output to terminate the attribute and inject event-handler attributes into the generated figure element. A user able to edit a wiki page can store JavaScript that executes in the wiki origin when visitors render the page. This issue is fixed in version 4.1.0.

CVSS scores

ScoreVersionSourceVector
7.5High 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

VendorProductVersionsSource
StarCitizenWiki mediawiki-extensions-EmbedVideo < 4.1.0 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-15
Last updated
2026-09-15
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.49%
Probability of exploitation in 30 days
42.5%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-79
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')