CVE-2026-104466

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description A stored cross-site scripting issue exists in the formatters/wakka.php file. Users with permissions to edit pages or post comments can inject event handlers by inserting quotes into markdown image URLs. This allows an attacker to craft a markdown image where the src attribute is bypassed to include an onerror handler, resulting in the execution of arbitrary JavaScript in the browsers of users who view the page, including those with administrator privileges.

Recommendations Update to version 4.6.7 or later.