CVE-2026-116884

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.

• CWE-79

• https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-4wj6-wmjp-pmhhExploit, Mitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/semanticmediawiki-5.0.0-before-7.3.1-stored-xss-via-tooltip-module-data-attributesThird Party Advisory
• https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-4wj6-wmjp-pmhhExploit, Mitigation, Vendor Advisory

Published

Oct 27, 2026

Last Modified

Oct 31, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116879Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missin…5.4
• CVE-2026-11688Inappropriate implementation in SVG in Google Chrome prior t…8.8
• CVE-2026-116880Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-…7.1
• CVE-2026-116881Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-…6.1
• CVE-2026-116882Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored…4.8
• CVE-2026-116883Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored…4.8
• CVE-2026-116885Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflec…6.1
• CVE-2026-116886Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored…5.4
• CVE-2026-116887Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored…5.4
• CVE-2026-116888SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored …5.4
• CVE-2026-116889SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored …6.1
• CVE-2026-11689Insufficient policy enforcement in Passwords in Google Chrom…8.1