The vulnerability occurs when the query debug output of Semantic MediaWiki is rendered as raw HTML without proper context encoding. An attacker can supply malicious script fragments as part of a query or the special request parameter on Special:Ask. Because the output is directly echoed back to the browser without passing through theWiki parser or sanitizer, the injected payload can be executed in the victim’s browser. This reflected XSS allows an attacker to perform actions such as session hijacking, defacement or further malicious activity, and it can be triggered with any anonymous web request.

Semantic MediaWiki, the open‑source extension for MediaWiki, is affected in all releases before version 7.2.0. The flaw resides in the SMW\Query\DebugFormatter component that assembles debug output for the format=debug parameter on Special:Ask. Users of the extension should verify the installed version and consider it vulnerable if it is older than 7.2.0.

The CVSS score is 6.1, indicating a moderate severity reflected XSS. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires no special user rights; an attacker only needs to craft a request containing a malicious query or debug flag. The vulnerability is therefore easily exploitable by any anonymous collaborator or attacker who can influence a victim’s browser session.