What is the CVSS score of CVE-2026-55691?

CVE-2026-55691 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.

Which versions of EmbedVideo MediaWiki Extension are affected by CVE-2026-55691?

The StarCitizenWiki EmbedVideo MediaWiki extension (versions ≤4.0.0) contains a stored cross-site scripting vulnerability allowing any wiki user to inject malicious scripts executed in the browsers…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55691?

Yes, a public proof-of-concept exploit is available for CVE-2026-55691. Prioritise patching immediately.

How to fix or mitigate CVE-2026-55691?

Within 24 hours: Identify all MediaWiki instances using the EmbedVideo extension and document their current versions. Within 7 days: Upgrade EmbedVideo to a version > 4.0.0 per vendor advisory on all affected systems, testing in non-production environments first. Within 30 days: Audit pages for injected malicious content, review access logs for suspicious activity, and assess whether user sessions require invalidation.

EmbedVideo MediaWiki Extension CVE-2026-55691

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-19 https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

GHSA-7h5p-637f-jfr7

PHP XSS

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS needs an editor account (PR:L) and a victim to view the page and trigger onmouseover (UI:R); script runs in the wiki origin affecting other users (S:C) with limited confidentiality/integrity impact and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jun 19, 2026 - 23:30 vuln.today

Analysis Generated

Jun 19, 2026 - 23:30 vuln.today

CVE Published

Jun 19, 2026 - 21:15 github-advisory

HIGH 8.6

DescriptionGitHub Advisory

Summary

The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.

Details

The template here adds a figure with a class that is substituted in. This value is provided to sprintf here, an unescaped version of the class supplied by the user.

$template = <<<HTML
    <figure class="%s" data-service="%s" %s %s>
        <div class="embedvideo-wrapper" %s>%s%s%s</div>%s
    </figure>
HTML;

PoC

Note the double quote immediately following the single quote to escape the class attribute in the template:

<youtube class='" onmouseover="alert(document.domain)' id="dQw4w9WgXcQ">dQw4w9WgXcQ</youtube>

Impact

Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.

AnalysisAI

Stored cross-site scripting in the StarCitizenWiki EmbedVideo MediaWiki extension (versions <= 4.0.0) allows any wiki user to inject arbitrary HTML and JavaScript into rendered pages by abusing the unsanitized class attribute on embed tags such as <youtube>. Because the user-supplied class is concatenated into an HTML template via sprintf without escaping, an attacker can break out of the class attribute and execute script in the context of every visitor that views the page. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain wiki edit rights

Delivery

Insert embed tag with crafted class attribute

Exploit

Save page with stored payload

Execution

Victim renders page and triggers onmouseover

Persist

Script executes in victim origin

Impact

Steal session or escalate to sysop

Access

Obtain wiki edit rights

Delivery

Insert embed tag with crafted class attribute

Exploit

Save page with stored payload

Execution

Victim renders page and triggers onmouseover

Persist

Script executes in victim origin

Impact

Steal session or escalate to sysop

Vulnerability AssessmentAI

Exploitation	Requires (1) a MediaWiki installation with the EmbedVideo extension at version <= 4.0.0 enabled, (2) the attacker to have permission to edit a page and insert one of the extension's embed tags (default MediaWiki configuration grants edit rights to registered, and often anonymous, users), and (3) a victim to view the resulting page - the published PoC uses an onmouseover handler, so trivial hover over the embed triggers script execution. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) overstates real-world severity: although the vector is network-reachable and requires no authentication on the request that triggers rendering, persisting the malicious payload realistically requires a wiki account with edit rights, and successful exploitation requires a victim to view the affected page (effectively UI:R for impact). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with edit rights on a target wiki adds an embed tag such as <youtube class='" onmouseover="alert(document.domain)' id="dQw4w9WgXcQ">dQw4w9WgXcQ</youtube> (the advisory's published PoC) to any page; when another user - ideally a sysop - loads the page and moves the mouse over the rendered figure, the attacker-controlled JavaScript executes in the victim's browser under the wiki's origin. From there the attacker can steal session cookies/CSRF tokens, perform actions as the victim (including granting admin rights or planting further payloads), or pivot to internal services reachable from authenticated browsers.
Remediation	Vendor-released patch: upgrade starcitizenwiki/embedvideo to version 4.1.0 or later (release https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0), which replaces the sprintf-based HTML assembly with MediaWiki's TemplateParser and Html::element helpers that perform proper attribute escaping (fix commit 370156335b325bb81d14d89edf0a1f2643d50a84). … Detailed patch versions, workarounds, and compensating controls in full report.