- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 5 · 5 high
- Registry
- Packagist
Advisories 5
- CVE-2026-57440High 7.5
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
Affected: fixed in 4.1.0.
- CVE-2026-55691High 8.6
EmbedVideo Extension : Stored XSS via unsanitized class passed to template
Affected: fixed in 4.1.0.
- CVE-2026-55690High 7.5
EmbedVideo Extension: Stored XSS via unsanitized service name in exception text
Affected: fixed in 4.1.0.
- CVE-2026-55692High 7.5
EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
Affected: fixed in 4.1.0.
- CVE-2025-59839High 8.6
Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes
Affected: through 4.0.0.