YesWiki up to 4.6.5 Bazar Widget /HomePage/widget strip_tags ID cross site scripting

Summaryinfo

A vulnerability was found in YesWiki up to 4.6.5 and classified as problematic. Affected is the function strip_tags of the file /HomePage/widget of the component Bazar Widget Handler. Such manipulation of the argument ID leads to cross site scripting. This vulnerability is referenced as CVE-2026-52774. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in YesWiki up to 4.6.5 and classified as problematic. Affected by this issue is the function strip_tags of the file /HomePage/widget of the component Bazar Widget Handler. The manipulation of the argument id with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication. During validation, the vulnerable widget route returned the injected HTML for both /HomePage/widget?id=... and /NoSuchPage/widget?id=..., which shows that no login, no page ownership, no edit rights, and not even a valid page tag were required. The only routing prerequisite observed was that the Bazar extension is enabled and the request includes an id parameter. This issue has been patched in version 4.6.6.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-52774 since 06/08/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 4.6.6 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Name

• YesWiki

Version

• 4.6.0
• 4.6.1
• 4.6.2
• 4.6.3
• 4.6.4
• 4.6.5

Website

• Product: https://github.com/YesWiki/yeswiki/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion