YesWiki is a wiki system written in PHP.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 2, 2026 · NIST NVD

   Detected

   YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.

2. Oct 6, 2026 · NIST NVD

   Updated

   YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.

Affected

• cpe yeswiki/yeswikiversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-34598

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-34598

  YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits

  nvd.nist.gov

References

• Product · github.com
• Exploit · github.com