EmbedVideo Extension EUVD-2026-86396

Requires the non-default configuration $wgEmbedVideoRequireConsent to be DISABLED - the advisory states this is not the default, so out-of-the-box installations are not affected. The attacker must be able to insert an EmbedVideo parser function/tag (#ev or an embed tag) into wiki content, i.e. hold page-edit capability, and supply a malformed URL/id containing a double quote to escape the iframe src attribute. Exploitation is limited to affected EmbedVideo versions prior to 4.1.0, and as stored XSS it further depends on another user rendering the poisoned page for the injected script to fire.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) is internally inconsistent with the vulnerability class. This is a stored HTML/JavaScript injection (CWE-79 XSS) in a wiki page, yet the vector shows C:H/I:N/A:N with no scope change and no user interaction - an atypical profile for reflected/stored XSS, which usually yields C:L/I:L with S:C. The single most important limiting signal is buried in the description: exploitation requires $wgEmbedVideoRequireConsent to be DISABLED, which the advisory explicitly states is NOT the default. That makes real-world exposure materially narrower than the 7.5 score implies. There is no EPSS score, no CISA KEV listing, and no public POC in the supplied intelligence, so there is no evidence of active or automated exploitation - this is a code-fix advisory (GitHub Security Advisory GHSA-v65j-hff3-753c) with a confirmed patch commit, not an emergent threat. Net: treat as a real but non-urgent hardening priority for the subset of MediaWiki sites running EmbedVideo with consent-requirement turned off. Verify the auth/UI assumptions with the vendor - the description implies an attacker must edit a page and a victim must view it, which contradicts the PR:N/UI:N in the input vector.

On a wiki running EmbedVideo with $wgEmbedVideoRequireConsent disabled, an attacker who can edit a page inserts an #ev parser function (or embed tag) with a malformed video URL/id crafted to contain a double quote, breaking out of the iframe src attribute. The injected attribute/markup is stored and rendered to every subsequent viewer, executing attacker JavaScript in their browser session. No public exploit code is identified at time of analysis, but the injection technique is described plainly in the advisory and the fixing commit.