Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M

CVE-2026-34598YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"

High 7.1

In plain English

A high-severity cross-site scripting in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	yeswiki/yeswiki	4.6.0	GHSA-37fq-47qj-6j5j

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	< 4.6.0

Weakness: CWE-79, CWE-87 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-37fq-47qj-6j5j x_refsource_CONFIRM
https://github.com/YesWiki/yeswiki/releases/tag/v4.6.0 x_refsource_MISC