The vulnerability resides in the way Semantic MediaWiki processes the "sep" parameter supplied to the Special:Ask table. Prior to version 7.2.0, the value of this parameter was inserted directly into the generated HTML without sanitization, allowing an attacker to inject arbitrary HTML or JavaScript. The weakness is a reflected XSS flaw, formally identified as CWE‑79. This allows a malicious user to steal session cookies, deface pages, or carry out other malicious actions in the context of any other user viewing the affected page.

Semantic MediaWiki extensions for MediaWiki are affected. The issue exists in all releases earlier than 7.2.0; the fix is included in Semantic MediaWiki 7.2.0 and later. The product is freely available under an open‑source license and can be used in any MediaWiki deployment that includes the Semantic MediaWiki extension.

The CVSS score of 6.1 reflects a moderate severity, indicating that the flaw can lead to a compromise of user data and potential defacement. EPSS is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote, via a web request that includes a crafted "sep" parameter; any user with access to the Special:Ask page and the ability to supply that parameter could exploit the flaw.