Is CVE-2025-61682 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61682 being exploited in the wild.

How severe is CVE-2025-61682?

High severity, with a CVSS score of 8.6, published 18 September 2026.

Which products and versions are affected?

mediawiki/semantic-media-wiki (Packagist) >= 3.1.0, < 7.0.0, ECOSYSTEM:introduced=3.1.0,fixed=7.0.0; Semantic MediaWiki 3.1.0 through 6.x (fixed in 7.0.0).

Is there a fix for CVE-2025-61682?

Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61682 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-61682?

Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61682: Semantic MediaWiki stored XSS through wikitext data attributes

Q: Is there a fix for CVE-2025-61682?

Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-61682 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-61682?

Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61682 · Severity: high · CVSS 8.6 · Published 2026-09-18

Semantic MediaWiki is a MediaWiki extension that enables structured data management within wiki pages. A vulnerability allows any user with edit permissions to inject arbitrary JavaScript code by crafting specially-formed wikitext, which is then executed in the browsers of all users viewing the affected page. This could lead to session hijacking, credential theft, or malware distribution.

Technologies: mediawiki/semantic-media-wiki (Packagist), Semantic MediaWiki. Vendors: Packagist, Semantic MediaWiki.

Quick answers

Is CVE-2025-61682 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61682 being exploited in the wild.
How severe is CVE-2025-61682?: High severity, with a CVSS score of 8.6, published 18 September 2026.
Which products and versions are affected?: mediawiki/semantic-media-wiki (Packagist) >= 3.1.0, < 7.0.0, ECOSYSTEM:introduced=3.1.0,fixed=7.0.0; Semantic MediaWiki 3.1.0 through 6.x (fixed in 7.0.0).
Is there a fix for CVE-2025-61682?: Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61682 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-61682?: Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mediawiki/semantic-media-wiki (Packagist): upgrade to 7.0.0 or later
```
composer require mediawiki/semantic-media-wiki:^7.0.0
```

Technical details

This is a stored cross-site scripting (XSS) vulnerability caused by improper handling of HTML data attributes in the ext.smw.js JavaScript file. The vulnerable code parses the `data-subtab` attribute of elements with the `smw-subtab` class as JSON and directly appends it to the element's `innerHTML` without sanitization. Since non-reserved data attributes can be specified in MediaWiki wikitext markup using the `{{#tag:div}}` syntax, an attacker with edit permissions can craft a payload containing JavaScript-executing HTML (e.g., `<img src='' onerror=alert(1)>`) that will be parsed and executed when the page loads. No user interaction or special privileges beyond basic edit rights are required to exploit this vulnerability. The vulnerability affects all versions from 3.1.0 through 6.x, and is fixed in version 7.0.0 and later.

Affected products

Semantic MediaWiki Semantic MediaWiki 3.1.0 through 6.x (fixed in 7.0.0)

Identifiers

CVE-2025-61682
GHSA-hg8h-557g-q8pp

Timeline

2026-09-15: disclosed: Vulnerability published by GitHub Advisory Database
2026-09-15: patched: Fix released in version 7.0.0

References

https://api.github.com/users/SomeMWDev

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.