CVE-2026-34598
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database.
When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.
MEDIUM · CVSS 6.1
EPSS 0.00082
Schedule remediation
- Public exploit or PoC is available
Sigma rules0
YARA rules0