CVE-2026-55690
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The EmbedVideo extension for MediaWiki prior to 4.1.0 interpolates an attacker-controlled unknown service name into exception text, then returns that text as HTML without neutralization. Both the #ev parser function and the evl parser form can reach this error path.
Risk Assessment
A user able to edit a wiki page can inject stored HTML or JavaScript into the error output, causing code execution in the wiki origin for visitors. This leads to session hijacking or other actions on behalf of victims.
Recommendation
Upgrade the EmbedVideo extension to version 4.1.0 or later. Until then, consider restricting wiki page edit permissions.
Other vulnerabilities in EmbedVideo Extension
See all- CVE-2026-57440High
EmbedVideo Extension, a MediaWiki extension adding a #ev parser function and tags for embedding video clips from various services, prior to 4.1.0 with $wgEmbedVideoRequireConsent disabled (not the default) passes video URLs into an iframe src attribute without sanitization. When given a malformed URL or id, the src attribute can be escaped via double quotes, allowing HTML/JavaScript injection. Version 4.1.0 contains a patch.
- CVE-2026-55692High
The EmbedVideo extension for MediaWiki prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration, places JSON into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs can terminate the attribute and inject event-handler attributes into the generated figure element.
- CVE-2026-55691High
The EmbedVideo extension for MediaWiki prior to 4.1.0 passes the user-supplied class value directly to sprintf when constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page.
- CVE-2025-59839High
The EmbedVideo Extension for MediaWiki, in versions 4.0.0 and prior, allows adding arbitrary attributes to an HTML element, enabling stored XSS through wikitext. This has been patched in commit 4e075d3.
Original NVD description (English source)
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedServiceFactory::newFromName in includes/EmbedService/EmbedServiceFactory.php interpolates an attacker-controlled unknown service name into exception text, and includes/EmbedVideo.php returns that text as HTML through the isHtml output path without neutralization. Both the #ev parser function and the evl parser form can reach this error path. A user able to edit a wiki page can inject stored HTML or JavaScript into the error output, causing code to execute in the wiki origin for visitors who render the page. This issue is fixed in version 4.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS