# CVE-2026-116881: Semantic MediaWiki cross-site scripting in property-value autocomplete

Source: https://junglewise.ai/threats/cve-2026-116881-semantic-mediawiki-from-3-0-0-before-7-3-1-contains-a-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116881 · Severity: medium · CVSS 6.1 · Published 2026-10-27

Semantic MediaWiki is a plugin for MediaWiki that adds structured data capabilities to wikis. An attacker who stores malicious markup in semantic property values can inject code into the autocomplete dropdown that other users see when searching for property values, potentially leading to credential theft or account compromise through script execution.

Technologies: [Semantic MediaWiki](https://junglewise.ai/threats/technologies/semantic-mediawiki). Vendors: [Semantic MediaWiki](https://junglewise.ai/threats/vendors/semantic-mediawiki).

## Quick answers

**Is CVE-2026-116881 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116881 being exploited in the wild.

**How severe is CVE-2026-116881?** Medium severity, with a CVSS score of 6.1, published 27 October 2026.

**Which products and versions are affected?** Semantic MediaWiki 3.0.0 before 7.3.1.

**Is there a fix for CVE-2026-116881?** Yes: fixed in 7.3.1. Until then: Disable the property-value autocomplete widget if it is not required, or restrict the ability to create or modify semantic properties to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116881 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116881?** Check whether you run Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.3.1

Disable the property-value autocomplete widget if it is not required, or restrict the ability to create or modify semantic properties to trusted users only.

## Technical details

A cross-site scripting vulnerability exists in the property-value autocomplete widget where the PValueLookup API returns unescaped semantic values that are directly concatenated into HTML via jQuery's .html() method in jquery.autocomplete.js. When a user opens the autocomplete with an empty query, an attacker-controlled property value can inject arbitrary markup or scripts into the dropdown. The vulnerability requires the property-value autocomplete to be enabled and user interaction to trigger the autocomplete dropdown.

## Affected products

- Semantic MediaWiki Semantic MediaWiki 3.0.0 before 7.3.1

## Timeline

- 2026-09-28: disclosed
- 2026-10-27: advisory

## References

- [https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-mvpf-4wj8-2hwf](https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-mvpf-4wj8-2hwf)
- [https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-xss-via-property-value-autocomplete](https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-xss-via-property-value-autocomplete)

## Related threats

- [Semantic MediaWiki authorization bypass in edit protection](https://junglewise.ai/threats/cve-2026-126566-semantic-mediawiki-7-3-1-before-7-4-1-contains-an-incorrect)
- [Semantic MediaWiki denial of service in concept expansion](https://junglewise.ai/threats/cve-2026-126565-semantic-mediawiki-3-0-0-before-7-4-1-contains-a-denial-of)
- [Semantic MediaWiki stored XSS in ValueFormatter property label](https://junglewise.ai/threats/cve-2026-126564-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-stored-cross)
- [Semantic MediaWiki uncontrolled recursion in ConceptDescriptionInterpreter](https://junglewise.ai/threats/cve-2026-126562-semantic-mediawiki-3-0-0-before-7-4-1-contains-an-uncontrolled)
- [Semantic MediaWiki missing authorization in page edit protection](https://junglewise.ai/threats/cve-2026-126561-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-missing)