CVE-2025-61682

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions 3.1.0 through 6.x

Description Stored Cross-Site Scripting (XSS) is possible through wikitext because the extension inserts the unsanitized value of a data attribute into the Document Object Model (DOM) as HTML. Specifically, in the ext.smw.js file, the data-subtab attribute of elements with the smw-subtab class is parsed as JSON and appended to the innerHTML of the element. Since most data attributes can be used in wikitext, a user with edit permissions can insert arbitrary HTML and JavaScript.

Recommendations Update Semantic MediaWiki to version 7.0.0.