Semantic MediaWiki is an open‑source extension that allows data storage within wiki pages. A flaw in versions from 3.1.0 up to but not including 7.0.0 caused the extension to insert the value of a data attribute directly into the HTML DOM without sanitization. This permits stored cross‑site scripting when an attacker injects malicious wikitext. The resulting script runs in the browser of any user viewing the vulnerable page, potentially leading to credential theft, session hijacking, or defacement. This is a classic stored XSS weakness, identified as CWE‑79. Based on the description, it is inferred that the attacker must be able to edit page content to inject the malicious data attribute; unauthenticated editing is not explicitly stated, but the flaw exists in the rendering path that is executed for all page views.

SemanticMediaWiki extension for MediaWiki. All installations running any version from 3.1.0 through the 6.x releases are affected. Version 7.0.0 and later contain the patch that removes the unsanitized data attribute handling.

The CVSS base score of 8.6 indicates high severity. The EPSS score of < 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed widespread active exploitation has been reported. Based on the description, it is inferred that the vulnerability can be triggered by adding malicious wikitext during an editing operation, after which the malicious script is stored and runs for any user who views the page. Because the flaw is stored, it can be abused repeatedly unless mitigated, and the lack of an official workaround means that patching is the only reliable defense.