Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104466YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

Medium 5.4

In plain English

A medium-severity cross-site scripting in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 93.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators.

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.6.7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-7pv9-pwm8-cwwr) vendor-advisory
VulnCheck Advisory: YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute third-party-advisory