Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104473YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

Medium 6.1

In plain English

A medium-severity cross-site scripting in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 83.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	yeswiki/yeswiki	4.6.0	GHSA-5724-x3rh-5qqq

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.5.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-5724-x3rh-5qqq) vendor-advisory
VulnCheck Advisory: YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages third-party-advisory