CVE-2026-52774

Name of the Vulnerable Software and Affected Versions YesWiki version 4.6.5

Description An issue exists in the Bazar widget handler where the id GET parameter is reflected into HTML attributes using only the strip tags() function. Since strip tags() does not escape double quotes, an unauthenticated attacker can break out of the attribute value and inject event handlers, such as onmouseover, to execute arbitrary JavaScript in the victim's browser. This behavior occurs because the widget route does not perform authentication or access-control checks, requiring only that the Bazar extension be enabled and the id parameter be present. The reflection occurs within the data-formid and data-iframeUrl attributes of the widgetapp element, processed by the WidgetHandler.php handler and the widget.tpl.html template.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Bazar widget handler or disable the Bazar extension to minimize the risk of exploitation.