Stored XSS in MediaWiki EmbedVideo Extension (CVE-2026-57440)

What happened

EmbedVideo, a MediaWiki extension for embedding videos through the #ev parser function and parser tags, contains a cross-site scripting vulnerability tracked as CVE-2026-57440. When the configuration setting $wgEmbedVideoRequireConsent is disabled (this is not the default setting), video URLs supplied to the extension are inserted into an iframe's src attribute without proper sanitization.

Technical cause

The vulnerability is classified as CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A malformed URL or video ID can be crafted to break out of the iframe src attribute using double quotes, allowing an attacker to inject arbitrary HTML or JavaScript into the resulting page. This occurs only when $wgEmbedVideoRequireConsent is disabled, since this setting otherwise affects how video URLs are processed before rendering.

Why it matters

The vulnerability has a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it can be exploited remotely over the network, requires no privileges, requires no user interaction, and has a low attack complexity. The impact is rated high for confidentiality. Because the injected content is persisted on a wiki page (stored XSS), it can affect any visitor who later views the page containing the malicious embed.

Who is affected

This affects MediaWiki sites running the starcitizenwiki/embedvideo extension (versions up to and including 4.0.0) where the non-default configuration option $wgEmbedVideoRequireConsent has been disabled. Sites running with the default configuration (consent enabled) are not described as affected in the available facts.

Affected versions

All versions from the initial release up to and including 4.0.0 of starcitizenwiki/embedvideo are affected.

Fixes and mitigation

Version 4.1.0 of starcitizenwiki/embedvideo contains a patch for this vulnerability. Site operators should update to 4.1.0 or later.

Recommended action

Update the EmbedVideo extension to version 4.1.0 or later as soon as possible. If an immediate update is not feasible, ensure $wgEmbedVideoRequireConsent remains enabled (the default setting), as the vulnerability only manifests when this option has been disabled.