CVE-2026-52772Medium· 5.5▾ TwilightPoC availableYesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has b…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 30.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
yeswiki/yeswiki < 4.6.6Patched in:
yeswiki/yeswiki 4.6.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-52762High· 7.1YesWiki is a wiki system written in PHP
CVE-2026-52766Critical· 9.1YesWiki is a wiki system written in PHP
CVE-2026-52767High· 8.2YesWiki is a wiki system written in PHP
CVE-2026-52769High· 8.3YesWiki is a wiki system written in PHP
CVE-2026-52770High· 7.5YesWiki is a wiki system written in PHP
CVE-2026-52773Medium· 6.1YesWiki is a wiki system written in PHP