A critical stored XSS vulnerability in the EmbedVideo extension for MediaWiki allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

The extension fails to properly sanitize input when processing parser functions, enabling the injection of arbitrary HTML attributes. This vulnerability is exploitable by unauthenticated users who can contribute wikitext to the platform.

The ability to execute arbitrary scripts via stored XSS poses a severe risk to organizational security, as it allows attackers to hijack user sessions, steal session cookies, or perform unauthorized actions on behalf of authenticated administrators. With a CVSS score of 8.6, this flaw is categorized as high severity due to its potential to compromise the integrity and confidentiality of the MediaWiki installation.

Immediate Action: As no formal release version containing the fix is currently listed, users should apply the upstream patch provided in commit 4e075d3 directly to their local installation.

Proactive Monitoring: Security teams should monitor server access logs for anomalous requests containing suspicious HTML tags or script injection patterns within wikitext fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious script injection attempts targeting the MediaWiki parser functions.

Public Exploit Available: No (the provided references point to the security advisory and fix commit, not a functional weaponized exploit).

Given the potential for session hijacking and the existence of a proof-of-concept, this vulnerability warrants immediate attention. Administrators must prioritize applying the identified fix commit and auditing existing pages for evidence of malicious injection to ensure the platform remains secure against unauthorized script execution.