CVE-2026-116888

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators.

• CWE-79

• https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-fp94-c5vh-cmhpExploit, Mitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/semanticmediawiki-3.2.0-before-7.3.1-stored-xss-via-special-browse-group-headingThird Party Advisory
• https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-fp94-c5vh-cmhpExploit, Mitigation, Vendor Advisory

Published

Oct 27, 2026

Last Modified

Oct 31, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116882Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored…4.8
• CVE-2026-116883Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored…4.8
• CVE-2026-116884SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored …6.1
• CVE-2026-116885Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflec…6.1
• CVE-2026-116886Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored…5.4
• CVE-2026-116887Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored…5.4
• CVE-2026-116889SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored …6.1
• CVE-2026-11689Insufficient policy enforcement in Passwords in Google Chrom…8.1
• CVE-2026-116890Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missin…7.3
• CVE-2026-116891SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflect…6.1
• CVE-2026-116892SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflect…6.1
• CVE-2026-116893REDAXO core before 5.21.5 contains a missing authorization v…6.8