Live › vulnerability › CVE-2026-116203
Go to dashboardYesWiki before 4.7.0 echoes attacker-controlled token values in its filtertags action without output encoding. An anonymous attacker can store markup that runs JavaScript in the browser of every visitor to the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
YesWiki installations before 4.7.0 that expose the filtertags action to visitors are affected, and the description says anonymous users can reach it. Sites that do not run YesWiki can skip this. The sources do not say whether the allow_raw_html setting changes exposure beyond bypassing its gate.
No product ranges from the sources yet.
4.7.0 are affected<script or event handlers in pages that use the filtertags action4.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allow_raw_html gate, executing JavaScript for every page viewer.
This page as .md · .json · in your agent: get_signal("CVE-2026-116203")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.