Stored XSS in MediaWiki EmbedVideo Extension via Unsanitized iframe Parameters

The EmbedVideo extension for MediaWiki (version 4.0.0 and earlier) contains a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-57440). The flaw exists when the non-default configuration $wgEmbedVideoRequireConsent is disabled. Under this configuration, the extension fails to sanitize video service URLs or IDs before passing them into the src attribute of an iframe. Because the regex patterns for specific services like archiveorg, wistia, and sharepoint allow double quotes, an attacker with page-editing permissions can escape the attribute context and inject arbitrary HTML event handler attributes, such as onfocus or onmouseover. This allows for the execution of unauthorized JavaScript in the context of the wiki origin when a victim views the affected page, leading to potential session hijacking or further malicious activity.

Impact

Successful exploitation allows any user with page-editing capabilities to achieve stored XSS. The injected payload executes automatically in the browser of any visitor viewing the compromised page, operating within the victim's session context on the wiki domain. This significantly increases the risk of account takeovers and unauthorized actions being performed on behalf of legitimate users, impacting the integrity of the wiki platform and its stored content.

Recommendation

Prioritize the following actions to secure the MediaWiki environment:

• Upgrade the EmbedVideo extension to a version beyond 4.0.0 immediately.
• Review the configuration file for the MediaWiki installation to ensure $wgEmbedVideoRequireConsent is set to true unless strictly required, as the vulnerability is dependent on this setting being disabled.
• Audit existing wiki pages for the presence of the <embedvideo> tag, particularly those added or modified by untrusted contributors, to check for signs of injection containing event handlers like onmouseover or onfocus.