CVE-2026-34598
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In YesWiki prior to version 4.6.0, a stored and blind XSS vulnerability was found in the form title field. An unauthenticated attacker can inject JavaScript that executes when other users visit the page.
Risk Assessment
The risk involves potential session theft, redirects to malicious sites, or user data theft.
Recommendation
It is recommended to upgrade to version 4.6.0, which contains the fix.
Original NVD description (English source)
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.