Stored Cross-Site Scripting in YesWiki by YesWiki
CVE-2026-116203

5.3MEDIUM

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116203?

YesWiki versions prior to 4.7.0 are vulnerable to a stored cross-site scripting (XSS) attack through the filtertags action. This vulnerability allows attackers to exploit unencoded token values, which can lead to the execution of arbitrary JavaScript for all users viewing affected pages. By injecting malicious markup into action-attribute parameters, attackers can bypass security measures and compromise the integrity of the web application. Users of YesWiki are urged to update to the latest version to mitigate this security risk.

Affected Version(s)

yeswiki 0 < 4.7.0

yeswiki 4.7.0

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-before-4.7.0...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

overtimepog
.