What is the CVSS score of CVE-2026-55690?

CVE-2026-55690 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Is there a public PoC exploit available for CVE-2026-55690?

Yes, a public proof-of-concept exploit is available for CVE-2026-55690. Prioritise patching immediately.

Is there a patch available for CVE-2026-55690?

Yes, a patch is available for CVE-2026-55690. Update the affected software to the latest version immediately.

PHP CVE-2026-55690

EUVD-2026-78831 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-19 https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

GHSA-c29q-5xm7-5p62

PHP XSS

7.5

CVSS 3.1 · Vendor: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

Severity by source

Vendor (https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.4 MEDIUM

Editor account required (PR:L), victim must load the poisoned page (UI:R), payload executes in browser origin separate from the wiki backend (S:C), and impact is typical stored-XSS C:L/I:L with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo).

CVSS VectorVendor: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 19, 2026 - 23:30 vuln.today

Analysis Generated

Jun 19, 2026 - 23:30 vuln.today

CVE Published

Jun 19, 2026 - 21:14 github-advisory

HIGH 7.5

DescriptionCVE.org

Summary

When passing an unknown service name to embedvideo, an error message is rendered containing the invalid service name. The service name is not sanitized and can contain HTML.

Details

There is a hardcoded list of allowed services in a switch statement inside EmbedServiceFactory#newFromName here. When the service name is not known, an exception is thrown with the service name injected into the message via sprintf here. This message is not sanitized and is marked as isHtml here. Similarly with {{evl: here.

PoC

// Must be on a page, not on ExpandTemplates
{{#ev:<img src=x onerror=alert(document.domain)>|dQw4w9WgXcQ}}
{{#evl:id=dummy|service=<img src=x onerror=alert(document.domain)>}}

Impact

Stored XSS that allows arbitrary Javascript/HTML insertion on any page that a user can edit. It requires no interaction and executes in the wiki origin for every visitor to the page.

AnalysisAI

Stored cross-site scripting in the EmbedVideo MediaWiki extension allows authenticated wiki editors to inject arbitrary JavaScript by providing a malicious service name in parser tags. An attacker with page edit privileges can embed HTML/JavaScript that executes in the context of any visitor's browser, leading to session hijacking, content defacement, or other client-side attacks. Publicly available exploit code exists, and affected versions <=4.0.0 of the composer package are vulnerable.