Medium severity · published Oct 2, 2026
CVE-2026-104473
YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YE
yeswiki · YesWiki
before 4.5.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104473
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104473
vendor-advisory
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq
third-party-advisory
https://www.vulncheck.com/advisories/yeswiki-before-4.5.3-multiple-reflected-xss-via-bazar-and-listpages
More from yeswiki
9.8
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
9.8
CVE-2026-52778
YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
9.8
CVE-2025-46348
YesWiki is a wiki system written in PHP
9.8
CVE-2025-46347
YesWiki is a wiki system written in PHP
9.8
CVE-2018-1000641
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code,…