---
id: CVE-2026-104473
title: >-
  YesWiki before 4.5.3 contains multiple reflected cross-site scripting
  vulnerabilities that allow remote attackers to inject JavaScript through
  unsanitized parameters such as incomingurl, id, file, tags, and template
summary: >-
  YesWiki before 4.5.3 contains multiple reflected cross-site scripting
  vulnerabilities that allow remote attackers to inject JavaScript through
  unsanitized parameters such as incomingurl, id, file, tags, and template.
  Attackers can lure a…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: YesWiki
product: yeswiki
affected:
  - yeswiki < 4.5.3
published: '2026-10-02'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:01.243'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104473'
references:
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/yeswiki-before-4.5.3-multiple-reflected-xss-via-bazar-and-listpages
    label: disclosure@vulncheck.com
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-06T16:21:39.816594Z'
epss: 0.00249
epssPercentile: 0.1618
ingestedAt: '2026-10-02T12:17:44.351Z'
---

## Overview

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.