CVE-2026-116884

SemanticMediaWiki versions 5.0.0 through 7.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw in the ext.smw.tooltip.tippy.js component. The root cause is the rendering of data-* attributes via innerHTML while allowHTML is enabled. An attacker with editor privileges can inject a .smw-...