Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Medium · CVSS 6.1

### Summary Special:FacetedSearch `cstate` hidden inputs enable reflected XSS (residual of CVE-2025-10354) ### Details #### Affected versions and vulnerable location - Confirmed present on latest shipped release tag available in the local clone: `SemanticMediaWiki/SemanticMediaWiki@7.2.0`. - Confirmed present on default branch `master` at HEAD `18f418b4cdf2875e67a741349179a22c1573f61c`.

Remediation

Upgrade mediawiki/semantic-media-wiki to 7.2.1 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-9rcc-pmj8-ffhr

← All threats