Threats tagged 'ghsa-pp7g-x87f-9vf5'

Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the ValueFormatter::getFormattedSubject() function. This flaw allows users with page-edit rights to inject malicious markup via a preferred property label containing an img onerror payload. The payload executes when any user, including administrators, views the Special:Browse page or uses the smwbrowse API. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level.