CVE-2026-57440

The EmbedVideo Extension for MediaWiki is vulnerable to HTML/JavaScript injection in versions prior to 4.1.0 . When the $wgEmbedVideoRequireConsent setting is disabled, the extension fails to sanitize video URLs passed into an iframe src attribute. An attacker can provide a malformed URL or ID us...