CVE Feed

    Dashboard / CVE / CVE-2026-57440

    CVE-2026-57440

    The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.

    Published:Sep 24, 2026
    Last Modified:Sep 29, 2026
    EPS:Sep 24, 2026
    EPSS Score:0.00255
    CVSS Score:7.5

    Affected Products

    Vendor
    Starcitizenwiki
    Product
    Mediawiki-extensions-embedvideo

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High