The vulnerability allows unauthenticated users to craft a URL that includes a user‑controlled id parameter in Special:SMWAdmin. Because the parameter is not escaped, the lookup page reflects the supplied value without filtering, resulting in reflected XSS. An attacker can lure an smw‑admin administrator into visiting a malicious link that injects arbitrary JavaScript, enabling the attacker to perform privileged actions while the administrator is logged in.

Semantic Media Wiki versions from 3.1.0 up to (but not including) 7.3.1 are affected. The vendor is Semantic MediaWiki and the product is the Semantic MediaWiki extension for MediaWiki. Users running any of these vulnerable releases should check which version they are on, as 7.3.1 and later include the fix.

The CVSS score of 5.3 indicates moderate risk. EPSS data is unavailable, so no estimation of exploitation frequency can be made. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to convince an administrator to visit a crafted link, so the attack vector is phishing or social engineering rather than a straightforward remote exploit.