CVE-2026-34598: YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-02 · updated 2026-10-06
Weakness: CWE-79

Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.

Affected products

yeswiki: before 4.6.0 — fixed in 4.6.0

How to fix

Upgrade to a fixed version: yeswiki 4.6.0. Check the vendor advisory for mitigations.

References

https://github.com/YesWiki/yeswiki/releases/tag/v4.6.0
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-37fq-47qj-6j5j

Get alerted when CVE-2026-34598 or the next vulnerability affects your stack