CVE-2026-55690

The EmbedVideo extension for MediaWiki contains a stored cross-site scripting vulnerability (CWE-79) in versions prior to 4.1.0. When the #ev parser function or the evl parser tag is invoked with an unknown video service name, EmbedServiceFactory::newFromName interpolates that attacker-controlled name into exception text, which includes/EmbedVideo.php then returns as raw HTML via the isHtml output path without escaping. Any user with permission to edit a wiki page can therefore inject stored HTML or JavaScript that executes in the wiki's origin for every visitor who renders the page, enabling session or credential theft and actions taken as the victim. The issue is fixed in EmbedVideo 4.1.0. No public proof of concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is none known.

What to do: Upgrade the EmbedVideo extension to version 4.1.0 or later immediately. Until patched, restrict page-editing rights to trusted users and search page content and histories for #ev and evl tags referencing unknown service names, reviewing rendered error output for injected markup. Audit logs for suspicious edits made before the upgrade, since stored payloads can persist in cached and historical page renders.