Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-116824

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in…

Risk score
47/100
CVSS
6.1 v3.1
Published
27 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any r…
Affected
See advisory
Fix
Upgrade the product to 4.7.0 or later.
Exploitation
No known exploitation

Why it is Yellow

  • CVSS 6.1 medium
  • On your watchlist: php

References

Original description

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.

Last activity 27 Oct 2026. Patch Forecast updates every hour.