SemanticMediaWiki from 2.5.0 through 7.3.0 holds a stored cross‑site scripting flaw that lets any user with page‑edit privileges insert malicious JavaScript into Code‑typed property values. The attacker crafts a JSON value that contains embedded HTML, which the CodeStringValueFormatter then renders unescaped on the Special:Browse view, causing the script to run in the browsers of visitors displaying that page.

The vulnerability affects SemanticMediaWiki releases starting at 2.5.0 up to, but not including, 7.3.1. Users running these versions on any MediaWiki instance are susceptible; the flaw is tied to the handling of the Code property within the SemanticMediaWiki extension.

The CVSS score of 5.3 indicates moderate risk. EPSS data is not available, and the flaw is not listed in the KEV catalog, suggesting limited public exploitation to date. Attackers need only edit or create pages to craft the payload; the code executes on any user who loads the edited page in the Special:Browse view, impacting confidentiality or integrity through user‑side scripting.