CVE-2026-55691
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The EmbedVideo extension for MediaWiki prior to 4.1.0 passes the user-supplied class value directly to sprintf when constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page.
Risk Assessment
A user able to edit a wiki page can store JavaScript that executes for visitors rendering the affected content. This leads to session hijacking or other actions in the wiki context.
Recommendation
Upgrade the EmbedVideo extension to version 4.1.0 or later. Until then, consider restricting wiki page edit permissions.
Other vulnerabilities in EmbedVideo Extension
See all- CVE-2026-57440High
EmbedVideo Extension, a MediaWiki extension adding a #ev parser function and tags for embedding video clips from various services, prior to 4.1.0 with $wgEmbedVideoRequireConsent disabled (not the default) passes video URLs into an iframe src attribute without sanitization. When given a malformed URL or id, the src attribute can be escaped via double quotes, allowing HTML/JavaScript injection. Version 4.1.0 contains a patch.
- CVE-2026-55692High
The EmbedVideo extension for MediaWiki prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration, places JSON into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs can terminate the attribute and inject event-handler attributes into the generated figure element.
- CVE-2026-55690High
The EmbedVideo extension for MediaWiki prior to 4.1.0 interpolates an attacker-controlled unknown service name into exception text, then returns that text as HTML without neutralization. Both the #ev parser function and the evl parser form can reach this error path.
- CVE-2025-59839High
The EmbedVideo Extension for MediaWiki, in versions 4.0.0 and prior, allows adding arbitrary attributes to an HTML element, enabling stored XSS through wikitext. This has been patched in commit 4e075d3.
Original NVD description (English source)
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedHtmlFormatter::toHtml in includes/EmbedService/EmbedHtmlFormatter.php passes the user-supplied class value directly to sprintf while constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page. A user able to edit a wiki page can store JavaScript that executes for visitors who render the affected content. This issue is fixed in version 4.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS