---
id: CVE-2026-104473
title: >-
  YesWiki before 4.5.3 contains multiple reflected cross-site scripting
  vulnerabilities that allow remote attackers to inject JavaScript through
  unsanitized parameters such as incomingurl, id, file, tags, and template
summary: >-
  YesWiki before 4.5.3 contains multiple reflected cross-site scripting
  vulnerabilities that allow remote attackers to inject JavaScript through
  unsanitized parameters such as incomingurl, id, file, tags, and template.
  Attackers can lure a…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: YesWiki
product: yeswiki
affected:
  - yeswiki < 4.5.3
published: '2026-10-02'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T12:17:20.483'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104473'
references:
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/yeswiki-before-4.5.3-multiple-reflected-xss-via-bazar-and-listpages
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-02T12:17:44.351Z'
---

## Overview

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.