CVE-2026-52774
Received Received - Intake

Stored XSS in YesWiki via Bazar Widget id Parameter

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: GitHub, Inc.

Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication. During validation, the vulnerable widget route returned the injected HTML for both /HomePage/widget?id=... and /NoSuchPage/widget?id=..., which shows that no login, no page ownership, no edit rights, and not even a valid page tag were required. The only routing prerequisite observed was that the Bazar extension is enabled and the request includes an id parameter. This issue has been patched in version 4.6.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-52774

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki before version 4.6.6 has a reflected cross-site scripting (XSS) vulnerability in its Bazar widget handler. The id GET parameter is reflected into HTML attributes without proper escaping. Since strip_tags() does not escape double quotes, attackers can inject event handlers like onmouseover to execute arbitrary JavaScript in a victim's browser. This requires no authentication and works even without valid page ownership or edit rights.

Detection Guidance

This vulnerability is specific to YesWiki versions prior to 4.6.6 and involves the Bazar widget handler. To detect it, check the version of YesWiki installed on your system. If the version is below 4.6.6, the system is vulnerable. No specific network commands are provided in the context.

Impact Analysis

An attacker could trick you into clicking a malicious link, leading to unauthorized JavaScript execution in your browser. This could allow theft of session cookies, sensitive data, or account takeover. Since no authentication is needed, any user visiting a crafted URL could be affected if the Bazar extension is enabled.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information, risking compliance with security requirements. Organizations using vulnerable versions may face regulatory penalties or reputational damage.

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.6 or later to patch the vulnerability. If upgrading is not possible, disable the Bazar extension or restrict access to the widget route until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart