StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
Summary
The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.
Details
The template here adds a figure with a class that is substituted in. This value is provided to sprintf here, an unescaped version of the class supplied by the user.
$template = <<<HTML
<figure class="%s" data-service="%s" %s %s>
<div class="embedvideo-wrapper" %s>%s%s%s</div>%s
</figure>
HTML;PoC
Note the double quote immediately following the single quote to escape the class attribute in the template:
<youtube class='" onmouseover="alert(document.domain)' id="dQw4w9WgXcQ">dQw4w9WgXcQ</youtube>Impact
Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | starcitizenwiki/embedvideo | < 4.1.0 | 4.1.0 |
References
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-7h5p-637f-jfr7
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo
- https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/releases/tag/v4.1.0
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L- Weakness (CWE)
CWE-79, CWE-80- Platform
- Composer
- Package
starcitizenwiki/embedvideo- Disclosed
- 19.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7h5p-637f-jfr7 - CC BY 4.0
Vulnerability history: starcitizenwiki/embedvideo
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 09.2025 09.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 5
Disclosures per year
- 2025: 1
- 2026: 4
-
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.