Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Summary The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Details In ext.smw.js, the data-subtab attribute of all elements with the smw-subtab class is parsed as JSON and appended to the innerHTML of t...