SemanticMediaWiki versions 3.1.0 through 6.x are vulnerable to stored cross-site scripting, which could allow unauthenticated attackers to execute malicious scripts in the context of user sessions.

This is a stored cross-site scripting (CWE-79) vulnerability where the application fails to neutralize unsanitized data attributes before rendering them as HTML. An unauthenticated attacker can leverage this flaw through crafted wikitext to execute arbitrary JavaScript in the victim's browser.

The vulnerability carries a CVSS score of 8.6, indicating a high severity risk. Successful exploitation could lead to unauthorized session hijacking, theft of sensitive user data, or unauthorized actions performed on behalf of authenticated administrators, significantly impacting the integrity and confidentiality of the wiki platform.

Immediate Action: Update the SemanticMediaWiki extension to version 7.0.0 or later immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review web server and application logs for suspicious wikitext patterns or unusual DOM injection attempts targeting the affected attributes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common XSS payloads, serving as a temporary measure until the software can be patched.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the presence of a proof-of-concept, organizations running SemanticMediaWiki must prioritize upgrading to version 7.0.0. Failure to patch leaves the platform open to persistent XSS attacks that can compromise the entire user base and administrative control of the wiki.