SemanticMediaWiki CVE-2026-116884

Requires an account with page-edit (editor) privileges to store the payload - the malicious .smw-highlighter span is wikitext-authorable and survives the MediaWiki Sanitizer because data-content/data-title/data-top/data-bottom/data-theme are non-reserved data-* attributes. The ext.smw.tooltip ResourceLoader module must be loaded on the rendered page (the PoC uses a {{#info:message=...}} tag to force this). A victim must then hover the planted element (UI:P) for the onShow handler to assign the attribute value to innerHTML. The condition is present in DEFAULT configuration because allowHTML:true is hardcoded at ext.smw.tooltip.tippy.js:51 and the tooltip binds globally via tippy.delegate('#bodyContent',{target:'.smw-highlighter'}). LIMITING FACTORS: editor-level write access is needed to plant the payload, and victim hover interaction is required to trigger it - there is no unauthenticated or zero-interaction path.

This is a medium-severity stored XSS (CWE-79) with a moderate, conditional real-world risk rather than an urgent emergency. The input CVSS 4.0 base score is 5.3, with VC:L/VI:L and a subsequent-system scope impact (SC:L/SI:L) reflecting that code runs in the victim's authenticated session. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle priority. CONFLICT TO VERIFY: the supplied CVSS 4.0 vector states PR:N (unauthenticated), but the description and GHSA root-cause analysis are explicit that an *editor* (a user with page-edit rights) must plant the malicious .smw-highlighter span - this is an authenticated-write prerequisite, so PR:N understates the real barrier; treat the practical privilege requirement as editor-level, not anonymous. UI:P is accurate: a victim must hover the element for the payload to fire. The upside for an attacker is that the victim can be an administrator, turning a low-privilege editor foothold into admin-session/CSRF-token theft (a privilege-escalation-by-XSS pattern). Net: a genuine issue worth patching within the vendor's suggested cycle, but gated behind requiring an editor account plus victim interaction, which keeps it well below a drop-everything priority.

An attacker who holds (or phishes/registers) an editor account saves a wiki page containing a {{#info:}} tag to force-load the tooltip module plus a crafted <span class="smw-highlighter" data-content="<img src=x onerror=...>">; when an administrator later views and hovers that element, the entity-decoded attribute is written to innerHTML via tippy's allowHTML:true sink and JavaScript executes in the admin's authenticated session, enabling CSRF-token theft and authenticated write-API abuse. A public PoC reference exists in the GHSA advisory (the exact wikitext payload), but it is not verified as working exploit code. Exploitation is not remote-unauthenticated: it requires editor privileges to store the payload and victim hover (UI:P) to trigger it.