Stored Cross-Site Scripting in YesWiki Affects User Comments
CVE-2026-116206

5.3MEDIUM

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116206?

YesWiki versions prior to 4.7.0 are susceptible to a stored cross-site scripting vulnerability. This issue allows authenticated users to maliciously inject scripts into comment bodies using the wakka raw-HTML syntax. Attackers can exploit the /api/comments endpoint to submit comments that are rendered unescaped through the Twig raw filter, resulting in unauthorized JavaScript execution within the sessions of both administrators and visitors. This vulnerability poses significant risks to user data and overall website integrity.

Affected Version(s)

yeswiki 4.2.0 < 4.7.0

yeswiki 4.7.0

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-4.2.0-before...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.