---
id: CVE-2025-59839
title: >-
  The EmbedVideo Extension is a MediaWiki extension which adds a parser function
  called #ev and various parser tags for embedding video clips from various
  video sharing services
summary: >-
  The EmbedVideo Extension is a MediaWiki extension which adds a parser function
  called #ev and various parser tags for embedding video clips from various
  video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension
  allows…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'
cwe:
  - CWE-79
vendor: star-citizen
product: embedvideo
affected:
  - embedvideo <= 4.0.0
published: '2025-09-25'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59839'
references:
  - url: >-
      https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20
    label: security-advisories@github.com
  - url: >-
      https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155
    label: security-advisories@github.com
  - url: >-
      https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/4e075d3dc9a15a3ee53f449a684d5ab847e52f01
    label: security-advisories@github.com
  - url: >-
      https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v
    label: security-advisories@github.com
  - url: >-
      https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-4j5h-mvj3-m48v
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00303
epssPercentile: 0.21216
ingestedAt: '2026-10-12T14:50:33.990Z'
---

## Overview

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.

## Affected

- `embedvideo <= 4.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.