CVE-2025-59839

HIGH

EmbedVideo < 4.0.0 - Stored Cross-Site Scripting via Arbitrary HTML Attributes

Title source: llm

Description

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.

References (4)

Core 4

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v

Patch x_refsource_misc

https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/4e075d3dc9a15a3ee53f449a684d5ab847e52f01

View Patch ZIP pw:eip

Product x_refsource_misc

https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20

Product x_refsource_misc

https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155

View Writeup ZIP pw:eip

Scores

CVSS v3 8.6

EPSS 0.0028

EPSS Percentile 20.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (2)

star-citizen/embedvideo < 4.0.0

starcitizenwiki/embedvideo 0Packagist

Published Sep 25, 2025

Tracked Since Feb 18, 2026