What is the CVSS score of EUVD-2026-78829?

EUVD-2026-78829 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Which versions of EmbedVideo Extension are affected by EUVD-2026-78829?

The StarCitizenWiki EmbedVideo MediaWiki extension in versions 4.0.0 and earlier contains a stored cross-site scripting vulnerability affecting all visitors to compromised pages.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-78829?

Yes, a public proof-of-concept exploit is available for EUVD-2026-78829. Prioritise patching immediately.

How to fix or mitigate EUVD-2026-78829?

Within 24 hours: Identify all instances running EmbedVideo extension version 4.0.0 or earlier. Within 7 days: Patch available per vendor advisory-upgrade to the patched version (verify exact fixed version in StarCitizenWiki security advisory). Within 30 days: Audit recent page revision history for injected JavaScript payloads; revoke unnecessary page-edit privileges and restrict editing to trusted administrators.

EmbedVideo Extension EUVD-2026-78829

| CVE-2026-55692 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-19 https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

GHSA-5c7p-g73q-rpg5

PHP XSS Microsoft

7.5

CVSS 3.1 · Vendor: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

Severity by source

Vendor (https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.4 MEDIUM

Network-reachable wiki edit endpoint (AV:N, AC:L); requires edit permission so PR:L not PR:N; autofocus removes UI; XSS executes in browser origin so S:C with C:L/I:L.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo).

CVSS VectorVendor: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 19, 2026 - 23:36 vuln.today

Analysis Generated

Jun 19, 2026 - 23:36 vuln.today

CVE Published

Jun 19, 2026 - 21:41 github-advisory

HIGH 7.5

DescriptionCVE.org

Summary

With $wgEmbedVideoRequireConsent enabled (the default), the urls for videos are stored in a json-ified data attributedata-mw-iframeconfig. When given a malformed url or id, the data-mw-iframeconfig attribute can be escaped via single quotes, allowing for html/javascript injection.

Details

The sprintf here adds the iframe config encoded as JSON here. When given a malicious url or id with a single quote, the $this->getUrl() call returns an unescaped payload that terminates the data-mw-iframeconfig attribute and allows for injecting attributes, including handlers, into the figure element. The id regex for the archiveorg service and the url regexes for the wistia and sharepoint services allow for single quotes to be introduced.

PoC

A couple of examples across services

Input:
<embedvideo service="archiveorg" id="x' onmouseover='alert(document.domain)' data-x='"></embedvideo>

Renders:
<figure class="embedvideo" data-service="archiveorg" data-mw-iframeconfig="{&quot;src&quot;:&quot;//archive.org/embed/x" onmouseover="alert(document.domain)" data-x="?autoplay=1&quot;}" style="width:640px">
<div class="embedvideo-wrapper" style="height:493px"><div class="embedvideo-consent" data-show-privacy-notice="1">
...
</div>
</figure>

Input:
{{#ev:wistia|https://wistia.com/medias/x'onmouseover='alert(document.domain)'}}

Renders:
<figure class="embedvideo" data-service="wistia" data-mw-iframeconfig="{&quot;src&quot;:&quot;//fast.wistia.net/embed/iframe/x" onmouseover="alert(document.domain)" ?autoplay="1&quot;}'" style="width:640px">
<div class="embedvideo-wrapper" style="height:360px"><div class="embedvideo-consent" data-show-privacy-notice="1">
...
</div>
</figure>

{{#ev:sharepoint|https://a.sharepoint.com/sites/x'onmouseover='alert(document.domain)'.aspx}}

Impact

Under the default $wgEmbedVideoRequireConsent = true configuration, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page.

AnalysisAI

Stored cross-site scripting in the StarCitizenWiki EmbedVideo MediaWiki extension (versions <= 4.0.0) allows any user with page-edit rights to inject arbitrary JavaScript into the data-mw-iframeconfig attribute by supplying a malformed URL or ID containing single quotes for the archiveorg, wistia, or sharepoint services. The flaw is present under the default $wgEmbedVideoRequireConsent=true configuration and executes in the wiki origin for every visitor that loads the affected page, with publicly available exploit code exists in the GHSA advisory.

Technical ContextAI

EmbedVideo is a MediaWiki extension (PHP, distributed via Composer as starcitizenwiki/embedvideo) that renders third-party video embeds. In EmbedHtmlFormatter.php the figure element is assembled with sprintf using a single-quoted template data-mw-iframeconfig='%s', and the value comes from AbstractEmbedService::getIframeConfig() which JSON-encodes a structure containing $this->getUrl(). JSON encoding escapes double quotes but not single quotes, and the input-validation regexes for the archiveorg id and the wistia/sharepoint url permit literal apostrophes, so an attacker-supplied single quote terminates the attribute and lets adjacent tokens be parsed as new HTML attributes. This is a classic CWE-79 improper output neutralization caused by mixing a single-quoted HTML attribute with JSON encoding that does not escape that delimiter.

RemediationAI

Vendor-released patch: 4.1.0 - upgrade the Composer package starcitizenwiki/embedvideo to version 4.1.0 or later, which replaces the sprintf-based attribute assembly with a TemplateParser plus Html::element/Html::rawElement calls that perform proper HTML attribute encoding (commit 370156335b325bb81d14d89edf0a1f2643d50a84). If immediate upgrade is not possible, the most effective compensating control is to set $wgEmbedVideoRequireConsent=false in LocalSettings.php, which removes the vulnerable data-mw-iframeconfig attribute from rendered output at the cost of losing the privacy-consent gate before embeds load third-party content; alternatively, restrict edit permissions so untrusted users cannot invoke <embedvideo> or {{#ev:...}} parser hooks, recognizing that this only mitigates rather than eliminates the issue for any account that can still edit. Refer to the GHSA advisory at https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-5c7p-g73q-rpg5 for vendor guidance.