CVE-2025-59839
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The EmbedVideo Extension for MediaWiki, in versions 4.0.0 and prior, allows adding arbitrary attributes to an HTML element, enabling stored XSS through wikitext. This has been patched in commit 4e075d3.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or content modification.
Recommendation
Update the EmbedVideo extension to a patched version (commit 4e075d3) or later.
Other vulnerabilities in EmbedVideo Extension
See all- CVE-2026-57440High
EmbedVideo Extension, a MediaWiki extension adding a #ev parser function and tags for embedding video clips from various services, prior to 4.1.0 with $wgEmbedVideoRequireConsent disabled (not the default) passes video URLs into an iframe src attribute without sanitization. When given a malformed URL or id, the src attribute can be escaped via double quotes, allowing HTML/JavaScript injection. Version 4.1.0 contains a patch.
- CVE-2026-55692High
The EmbedVideo extension for MediaWiki prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration, places JSON into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs can terminate the attribute and inject event-handler attributes into the generated figure element.
- CVE-2026-55691High
The EmbedVideo extension for MediaWiki prior to 4.1.0 passes the user-supplied class value directly to sprintf when constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page.
- CVE-2026-55690High
The EmbedVideo extension for MediaWiki prior to 4.1.0 interpolates an attacker-controlled unknown service name into exception text, then returns that text as HTML without neutralization. Both the #ev parser function and the evl parser form can reach this error path.
Original NVD description (English source)
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS