Medium severity · published Apr 21, 2026
CVE-2025-10354
Reflected Cross-Site Scripting (XSS) in Semantic MediaWiki
5.1
CVSS
0.3%
EPSS
No
On KEV
Description
Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Semantic MediaWiki · Semantic MediaWiki
5.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10354
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10354
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki
More from Semantic MediaWiki
6.1
CVE-2026-116892
SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile
6.1
CVE-2026-116891
SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate
6.1
CVE-2026-116889
SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property
6.1
CVE-2026-116884
SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes
6.1
CVE-2026-116875
SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters