CVE-2026-57440: Stored Cross-Site Scripting (XSS) in MediaWiki EmbedVideo Extension

Vulnerability ID: CVE-2026-57440
CVSS Score: 7.5
Published: 2026-09-25

CVE-2026-57440 is a high-severity stored Cross-Site Scripting (XSS) vulnerability affecting the EmbedVideo extension for MediaWiki. When the extension is configured with consent requirements disabled ($wgEmbedVideoRequireConsent = false), video URLs and service IDs are parsed and inserted directly into the 'src' attribute of a generated iframe element without sanitization or context-aware escaping. This allows an attacker with editing privileges to inject arbitrary JavaScript and execute malicious commands in the context of other users' sessions.

TL;DR

Stored Cross-Site Scripting (XSS) in the MediaWiki EmbedVideo extension before version 4.1.0 allows authenticated or anonymous page editors to execute arbitrary JavaScript in the browsers of wiki visitors when video consent overlays are disabled.

Technical Details

• CWE ID: CWE-79 (Improper Neutralization of Input During Web Page Generation)
• Attack Vector: Network (Remote)
• CVSS Severity: 7.5 (High)
• EPSS Score: 0.00255 (Percentile: 15.21%)
• Exploit Status: None / Unproven
• CISA KEV Status: Not Listed
• Ransomware Use: No Known Involvement

Affected Systems

• mediawiki-extensions-EmbedVideo
• mediawiki-extensions-EmbedVideo: < 4.1.0 (Fixed in: 4.1.0)

Code Analysis

Commit: 3701563

Rewrite HTML generation layer to use safe templates and built-in escaping utilities

Commit: a573a16

Secondary contextual commit fixing slash issues in archive.org service

Mitigation Strategies

• Upgrade EmbedVideo extension to version 4.1.0 or newer.
• Enable consent requirements in MediaWiki configuration ($wgEmbedVideoRequireConsent = true).
• Deploy a restrictive Content Security Policy (CSP) that blocks inline script execution ('unsafe-inline').

Remediation Steps:

1. Verify the installed version of EmbedVideo by checking 'extensions/EmbedVideo/extension.json'.
2. If the version is prior to 4.1.0, pull the latest stable version or apply the official patch.
3. Alternatively, modify 'LocalSettings.php' to set '$wgEmbedVideoRequireConsent = true;' as an immediate mitigation.
4. Restrict editing permissions on public wiki namespaces to trusted or autoconfirmed accounts.

References

• GitHub Security Advisory GHSA-v65j-hff3-753c
• Official Security Fix Commit
• Official CVE Registry Entry
• NVD Detail Page
• Repository Home Page
• JSON Definition (CvelistV5)
• Secondary Contextual Commit (Archive.org Slash Fix)

Read the full report for CVE-2026-57440 on our website for more details including interactive diagrams and full exploit analysis.