The flaw allows a reflected cross‑site scripting attack in SemanticMediaWiki’s Special:Ask page. Separator parameters (sep, propsep, valuesep, delim, separator) are output without HTML escaping when using the list, category, DSV, or CSV result printers. An attacker can craft a link using request_type=raw or request_type=special_page so that the target browser executes malicious JavaScript in the wiki’s origin, enabling theft of session identifiers or CSRF tokens.

SemanticMediaWiki, a MediaWiki extension, is affected in versions from 3.0.0 up to but not including 7.3.1. The vulnerability exists in all releases of that series in the specified range unless a fix has been applied.

The CVSS score of 5.3 indicates a moderate impact. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate exploitation likelihood under current data. Attackers need only an unauthenticated web request, typically from an external source, to deliver a crafted URL to a victim who clicks it or whose browser accesses it. The resulting JavaScript can execute with the privileges of the victim, potentially hijacking sessions or forging authenticated CSRF requests.