Vulnerability Details CVE-2026-116891
SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 6.1%
CVSS Severity
CVSS v3 Score 6.1
References
Products affected by CVE-2026-116891
-
cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*