Cross-Site Scripting Risk in YesWiki's Bazar Widget Handler

CVE-2026-52774

What is CVE-2026-52774?

YesWiki, a PHP-based wiki system, exposes a cross-site scripting vulnerability through its Bazar widget handler prior to version 4.6.6. The handler incorrectly processes the id GET parameter by utilizing strip_tags(), which fails to adequately escape double quotes, allowing an attacker to break free from the attribute value. This enables the injection of malicious event handlers, such as onmouseover, leading to the execution of arbitrary JavaScript code in the browser of users. Notably, this vulnerability can be exploited without requiring user authentication or adherence to any ownership or editing permissions, as long as the Bazar extension is enabled and the request contains an id parameter. The issue has been addressed in the patched version 4.6.6.

References