Cross‑Site Scripting (XSS) is reflected in the Semantic MediaWiki application. By sending a victim a specially crafted URL that includes malicious JavaScript in the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter, an attacker can run code in the victim’s browser. This can lead to theft of session cookies, privilege escalation or other actions performed with the victim’s credentials.

Semantic MediaWiki, any release earlier than 5.0.2, is vulnerable. Versions 5.0.2 and newer contain the fix.

The vulnerability carries a CVSS score of 5.1, indicating moderate severity. No EPSS score is reported and it is not listed in the CISA KEV catalog, but the exploit is straightforward: an attacker only needs to embed the malicious payload in a URL that the victim visits. The attack does not require authentication and can be performed from any network, making it a classic reflected XSS risk.