CVE-2026-55692

The EmbedVideo extension for MediaWiki contains a stored cross-site scripting flaw (CWE-79) in versions prior to 4.1.0, where includes/EmbedService/EmbedHtmlFormatter.php writes service-supplied JSON into the data-mw-iframeconfig attribute without safely escaping single quotes. An attacker who can edit a wiki page can supply a crafted archiveorg identifier or a crafted Wistia or SharePoint URL that terminates the attribute and injects event-handler attributes into the rendered figure element. When another user visits the page, the injected JavaScript executes in the wiki's origin, allowing theft of session cookies or performance of actions as the victim. The flaw requires the default $wgEmbedVideoRequireConsent setting to be enabled and affects any wiki exposing editing to untrusted or semi-trusted accounts; it is fixed in 4.1.0. No public proof of concept is known and the issue is not listed in CISA's KEV, so there is no evidence of in-the-wild exploitation.

What to do: Upgrade the EmbedVideo extension to version 4.1.0 or later immediately. If an immediate upgrade is not possible, consider disabling the affected service validators (archiveorg, Wistia, SharePoint) or evaluating whether turning off $wgEmbedVideoRequireConsent sidesteps the vulnerable data-mw-iframeconfig code path. Review recent page histories and edits for archiveorg identifiers or Wistia/SharePoint URLs containing single quotes or unusual characters, and check access logs for wiki pages that rendered suspicious embeds.