CVE-2026-116824

MEDIUM 6.1

YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.

CWE	CWE-79
Vendor	yeswiki
Product	yeswiki
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for yeswiki yeswiki

Be the first to know when new medium vulnerabilities affecting yeswiki yeswiki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

YesWiki / yeswiki

0 < 4.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/YesWiki/yeswiki/security/advisories/GHSA-xcwg-2pj5-3qm4 vulncheck.com: https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-stored-xss-via-referer-header-in-referrers-sites-handler

Credits

🔍 manus-pi 🔍 manus-use