CVE-2026-34598 in yeswiki
Summary
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Responsible
GitHub_M
Reservation
03/30/2026
Disclosure
04/02/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354978 | yeswiki cross site scripting | 79 | Not defined | Official fix | CVE-2026-34598 |