CVE-2026-116824: YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrerssites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
YesWiki installations running versions before 4.7.0 are affected. An unauthenticated attacker can submit a crafted Referer header, while exploitation requires a user to later visit a referrer-sites page containing the stored value.
Does exploitation require an attacker account or elevated access?
No. The vulnerable handler accepts attacker-controlled Referer header content without requiring authentication; the attacker only needs to induce a request with a crafted Referer hostname.
What is the impact when the injected script executes?
The script executes in the YesWiki origin for a visitor of the affected page. It can perform same-origin actions using that visitor's authenticated session, with potential confidentiality and integrity impact.