The EmbedVideo extension processes a parser function and tags that embed videos from various services. When the configuration setting $wgEmbedVideoRequireConsent is set to false, the URL or identifier supplied to the extension is inserted directly into an iframe src attribute without sanitization. A malformed URL that contains a quote character can terminate the src attribute and inject arbitrary HTML or JavaScript. This behavior results in a stored cross‑site scripting vulnerability, allowing an attacker who can edit a page to plant malicious script that will execute in the browsers of any user who views the page.

StarCitizenWiki’s MediaWiki installation running the mediawiki-extensions-EmbedVideo prior to version 4.1.0, when the site configuration disables the consent requirement. Only installations using earlier releases are affected; versions 4.1.0 and later contain a patch.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is not available and the vulnerability is not currently catalogued in CISA KEV. Because the flaw requires a page edit, the attack vector is likely social‑engineering or exploitation of an existing privileged editor. Once injected, the malicious payload is stored in the page content and will execute for all viewers, providing an attacker with a persistent injection that can steal credentials or deface the site.