Semantic-Media-Wiki CVE-2026-7510 Reflected XSS via Forged Cursor Token

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: Reflected XSS in via a forged cursor pagination token CVE ID: CVE-2026-7510 Severity: Moderate, CVSS v3 Base Score 6.1 / 10 Affected Component: (Composer package) Affected Versions: Fixed Version: Vulnerability Mechanism: The query parameter in is used for list pagination (introduced in 7.0.0). While the token is encoded by , it relies on an unsigned base64-encoded JSON blob, with its content entirely controlled by the attacker. When the cursor anchor fails to match the requested / , throws an error message that inserts attacker-controllable / values, thereby triggering a reflected XSS. Impact Scope Attack Vector: Network Attack Complexity: Low Privileges Required: None (no authentication or special privileges required) User Interaction: Required (user must click a malicious link) Impact: An attacker can construct a link to inject HTML markup into (or ), executing scripts in the victim's browser. CWE: CWE-79 (Cross-Site Scripting) Mitigating Factors: Response headers include a , but inline scripts are not blocked. Remediation 1. Output Encoding: Output-encode the attacker-controllable / values before inserting them into error messages. 2. Defense in Depth: The identical error messages reflected in the / output paths have been separately fixed in GHS-6d9m-8mjd-44f6. 3. Maintenance Notes: Query error strings are rendered as raw HTML via . Any text added via is attacker-controllable and must be treated as untrusted, requiring output encoding or the use of message keys.

Goal Reached Thanks to every supporter — we hit 100%!

Semantic-Media-Wiki CVE-2026-7510 Reflected XSS via Forged Cursor Token

More from this source