CVE-2026-57440
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
EmbedVideo Extension, a MediaWiki extension adding a #ev parser function and tags for embedding video clips from various services, prior to 4.1.0 with $wgEmbedVideoRequireConsent disabled (not the default) passes video URLs into an iframe src attribute without sanitization. When given a malformed URL or id, the src attribute can be escaped via double quotes, allowing HTML/JavaScript injection. Version 4.1.0 contains a patch.
Risk Assessment
An attacker can inject malicious HTML/JavaScript into a MediaWiki page, potentially leading to session hijacking or other browser-based attacks. The risk exists only when the consent requirement option is disabled.
Recommendation
Upgrade EmbedVideo Extension to version 4.1.0 or later. If upgrading is not possible, enable $wgEmbedVideoRequireConsent or restrict embedding of video from untrusted sources.
Other vulnerabilities in EmbedVideo Extension
See all- CVE-2026-55692High
The EmbedVideo extension for MediaWiki prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration, places JSON into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs can terminate the attribute and inject event-handler attributes into the generated figure element.
- CVE-2026-55691High
The EmbedVideo extension for MediaWiki prior to 4.1.0 passes the user-supplied class value directly to sprintf when constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page.
- CVE-2026-55690High
The EmbedVideo extension for MediaWiki prior to 4.1.0 interpolates an attacker-controlled unknown service name into exception text, then returns that text as HTML without neutralization. Both the #ev parser function and the evl parser form can reach this error path.
- CVE-2025-59839High
The EmbedVideo Extension for MediaWiki, in versions 4.0.0 and prior, allows adding arbitrary attributes to an HTML element, enabling stored XSS through wikitext. This has been patched in commit 4e075d3.
Original NVD description (English source)
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS