CVE-2026-116892

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin.

• CWE-79

• https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/a77e592320707499769c9386a33d97bc966d9418Patch
• https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-375v-wx2r-4598Exploit, Mitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/semanticmediawiki-3.1.0-before-7.3.1-reflected-xss-via-special-search-smw-profileThird Party Advisory
• https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-375v-wx2r-4598Exploit, Mitigation, Vendor Advisory

Published

Oct 27, 2026

Last Modified

Oct 31, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116887Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored…5.4
• CVE-2026-116888SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored …5.4
• CVE-2026-116889SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored …6.1
• CVE-2026-11689Insufficient policy enforcement in Passwords in Google Chrom…8.1
• CVE-2026-116890Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missin…7.3
• CVE-2026-116891SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflect…6.1
• CVE-2026-116893REDAXO core before 5.21.5 contains a missing authorization v…6.8
• CVE-2026-116894REDAXO before 5.21.5 contains an insufficient session expira…4.2
• CVE-2026-116895REDAXO before 5.21.5 contains a cross-site request forgery v…5.4
• CVE-2026-116896REDAXO before 5.21.5 contains a missing authorization vulner…7.5
• CVE-2026-116897REDAXO core before 5.21.4 contains a missing authorization v…6.5
• CVE-2026-116898REDAXO before 5.21.4 contains a missing authorization vulner…7.1