Semantic MediaWiki allows users to embed data queries directly in wiki pages. In versions 7.0.0 through 7.1.0, the Special:Ask page accepts a cursor token for keyset pagination, but the token is treated as unsigned base‑64url encoded JSON that the attacker fully controls. If the token’s sort anchor does not line up with the request’s sort and order parameters, the code builds an error message that injects the attacker’s sort_prop or sort_order directly into a raw error string. That string bypasses MediaWiki’s message‑layer sanitisation, and the error widget emits the message as raw HTML. Consequently, an attacker can craft a cursor token containing script markup that is reflected in the browser when the victim visits a specially‑crafted link, giving the attacker the ability to run arbitrary JavaScript on the wiki’s origin without any authentication or special privileges.

The flaw resides in the Semantic MediaWiki extension for MediaWiki, disclosed in the SemanticMediaWiki:SemanticMediaWiki product line. It affects all installations running Semantic MediaWiki versions 7.0.0 through 7.1.0. The vulnerability was patched in the 7.2.0 release, so any deployment using 7.2.0 or newer is not vulnerable.

The CVSS v3.1 score of 6.1 marks this as a medium‑severity flaw. No exploit evidence is reported (EPSS not available), and the vulnerability is not listed in the CISA KEV catalog, though its impact remains clear: any user can trigger the reflected XSS via a crafted link, so the risk rises if the wiki is accessible to untrusted parties. The attack requires only a crafted URL; no user interaction beyond clicking the link and no elevated privileges are needed. Because the vulnerability is reflected in the error output, it is easy to execute and can be used to harvest credentials, deface content, or perform other client‑side attacks.