Semantic MediaWiki from 4.2.0 up to 7.3.1 contains a stored cross‑site scripting flaw that allows authenticated profile or schema editors to embed arbitrary HTML into exploration‑link labels. When those labels are rendered, the system passes them unescaped to Html::rawElement(), resulting in malicious markup being displayed on the Special:FacetedSearch page and potentially executed in the browsers of all viewers. This can lead to browser‑side attacks such as session hijacking, defacement, or data exfiltration.

The vulnerability affects installations of Semantic MediaWiki on MediaWiki platforms that enable the FacetedSearch extension, specifically versions 4.2.0 through 7.3.1. Any user with editing rights to profiles or schemas within those versions can create or modify compromised labels, making the flaw relevant to all sites that use the extension without restricting those privileges.

The CVSS score of 4.8 indicates a moderate impact, and the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers must obtain authenticated editing rights, but once they can, the stored XSS can affect every visitor of the Special:FacetedSearch page, enabling client‑side code execution and potential credential theft. Overall, the risk is moderate but can be significant for sites with many non‑trusted editors.