What is the CVSS score of CVE-2026-55691?

CVE-2026-55691 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.

Which versions of EmbedVideo MediaWiki Extension are affected by CVE-2026-55691?

The StarCitizenWiki EmbedVideo MediaWiki extension (versions ≤4.0.0) contains a stored cross-site scripting vulnerability allowing any wiki user to inject malicious scripts executed in the browsers…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55691?

Yes, a public proof-of-concept exploit is available for CVE-2026-55691. Prioritise patching immediately.

How to fix or mitigate CVE-2026-55691?

Within 24 hours: Identify all MediaWiki instances using the EmbedVideo extension and document their current versions. Within 7 days: Upgrade EmbedVideo to a version > 4.0.0 per vendor advisory on all affected systems, testing in non-production environments first. Within 30 days: Audit pages for injected malicious content, review access logs for suspicious activity, and assess whether user sessions require invalidation.

EmbedVideo MediaWiki Extension CVE-2026-55691

EUVD-2026-78832 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-19 https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

GHSA-7h5p-637f-jfr7

PHP XSS

8.6

CVSS 3.1 · Vendor: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

Severity by source

Vendor (https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS needs an editor account (PR:L) and a victim to view the page and trigger onmouseover (UI:R); script runs in the wiki origin affecting other users (S:C) with limited confidentiality/integrity impact and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo).

CVSS VectorVendor: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jun 19, 2026 - 23:30 vuln.today

Analysis Generated

Jun 19, 2026 - 23:30 vuln.today

CVE Published

Jun 19, 2026 - 21:15 github-advisory

HIGH 8.6

DescriptionCVE.org

Summary

The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.

Details

The template here adds a figure with a class that is substituted in. This value is provided to sprintf here, an unescaped version of the class supplied by the user.

$template = <<<HTML
    <figure class="%s" data-service="%s" %s %s>
        <div class="embedvideo-wrapper" %s>%s%s%s</div>%s
    </figure>
HTML;

PoC

Note the double quote immediately following the single quote to escape the class attribute in the template:

<youtube class='" onmouseover="alert(document.domain)' id="dQw4w9WgXcQ">dQw4w9WgXcQ</youtube>

Impact

Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.

AnalysisAI

Stored cross-site scripting in the StarCitizenWiki EmbedVideo MediaWiki extension (versions <= 4.0.0) allows any wiki user to inject arbitrary HTML and JavaScript into rendered pages by abusing the unsanitized class attribute on embed tags such as <youtube>. Because the user-supplied class is concatenated into an HTML template via sprintf without escaping, an attacker can break out of the class attribute and execute script in the context of every visitor that views the page. No public exploit identified at time of analysis beyond the advisory's own PoC, and the issue is not listed in CISA KEV.

Technical ContextAI

The EmbedVideo extension renders media embeds (YouTube, Vimeo, etc.) inside MediaWiki by composing a <figure> wrapper using a PHP here-doc template populated with sprintf in includes/EmbedService/EmbedHtmlFormatter.php. The value of $config['class'], which originates from a user-controlled attribute on the embed tag (e.g. <youtube class='...'>), is interpolated directly into the class="%s" placeholder without HTML-attribute escaping, a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected package is the Composer package starcitizenwiki/embedvideo (pkg:composer/starcitizenwiki_embedvideo), used by any MediaWiki instance that installs this extension and permits authors to write embed tags.

RemediationAI

Vendor-released patch: upgrade starcitizenwiki/embedvideo to version 4.1.0 or later (release https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0), which replaces the sprintf-based HTML assembly with MediaWiki's TemplateParser and Html::element helpers that perform proper attribute escaping (fix commit 370156335b325bb81d14d89edf0a1f2643d50a84). If immediate upgrade is impossible, restrict page-edit and embed-tag usage rights to trusted users only, audit existing pages containing <youtube>/<vimeo>/etc. tags for suspicious class attribute content, and consider temporarily disabling the EmbedVideo extension on wikis that accept anonymous or low-trust edits - note this removes all video embedding functionality. A strict Content-Security-Policy that disallows inline event handlers (no unsafe-inline, no script in attributes) materially blunts the impact but may break legitimate MediaWiki gadgets or skin features and is not a substitute for the patch. See advisory https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-7h5p-637f-jfr7.