Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-77606

Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Description

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when `headers=plain`, table header text was emitted into `<th>` via a raw HTML path. User-controlled `mainlabel` content could therefore become executable HTML. Version 7.2.0 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SemanticMediaWiki SemanticMediaWiki

  • < 7.2.0affected

References