CVE-2026-55691

The EmbedVideo extension for MediaWiki contains a stored cross-site scripting vulnerability in EmbedHtmlFormatter::toHtml (includes/EmbedService/EmbedHtmlFormatter.php), where the user-supplied class value is passed unsanitized into an sprintf call building a figure element. A crafted class value containing a quote character can break out of the HTML attribute, allowing arbitrary attributes or markup to be injected into the rendered page. Any user with permission to edit a wiki page can plant JavaScript that executes in the browsers of visitors who view the affected content, enabling session or credential theft and account takeover. All wikis running EmbedVideo prior to version 4.1.0 are affected, with the issue fixed in 4.1.0. No public proof of concept is known and there is no indication of in-the-wild exploitation, though the CVSS 3.1 base score is high at 8.6.

What to do: Upgrade EmbedVideo to version 4.1.0 or later on all affected wikis. Until patched, restrict page-editing rights to trusted users and review recent edits and page histories for suspicious class= values in #ev parser function calls or EmbedVideo parser tags. After upgrading, refresh parser caches so previously stored malicious markup is not served from cache.