This vulnerability allows users with page‑edit rights to store malicious HTML in a Keyword‑typed property that is displayed unescaped on the Special:Browse page. The stored HTML can contain event‑handler payloads that run JavaScript in the browsers of any site visitor, including administrators, giving the attacker the ability to read session tokens and perform actions on behalf of the victim. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

Semantic MediaWiki, version 3.0.0 through 7.3.0. The affected product is the Semantic MediaWiki extension for MediaWiki. Any installation that has not been upgraded to version 7.3.1 or later is vulnerable.

The CVSS score of 5.3 classifies the issue as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploits identified yet. Attackers must have page‑edit rights to inject the payload, after which the malicious script runs when other users, including administrators, view the Special:Browse page. While the initial requirement limits the threat to sites with editable Keyword properties, the potential to hijack session tokens and perform privileged actions means the risk to confidentiality and integrity is non‑trivial.