Semantic MediaWiki from version 3.1.0 up to 7.3.1 stores schema descriptions without escaping HTML before passing them to Html::rawElement(). An attacker with the smw‑schemaedit permission can embed arbitrary HTML or JavaScript. When a user views the affected schema, the stored script executes in that user’s browser, enabling phishing, data theft, or session hijacking. The weakness aligns with CWE‑79, a stored cross‑site scripting flaw.

The vulnerability affects Semantic MediaWiki, a MediaWiki extension, in releases beginning with 3.1.0 and continuing through 7.3.1. Any deployment of these versions that grants the smw‑schemaedit permission to users is susceptible.

The CVSS base score of 4.8 indicates moderate impact when the flaw is exploited. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated and possess smw‑schemaedit authority, so it is limited to users who can edit schema descriptions. If the required permission is widely available, the risk rises; otherwise, the potential attack surface is narrower.