CVE-2026-116824
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Oct 27, 2026
Vendor
unknown
Description
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.