Quick answers
- Is CVE-2026-52774 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52774 being exploited in the wild.
- How severe is CVE-2026-52774?
- Medium severity, with a CVSS score of 6.1, published 5 September 2026.
- Which products and versions are affected?
- yeswiki/yeswiki (Packagist) < 4.6.6, ECOSYSTEM:introduced=0,fixed=4.6.6; YesWiki < 4.6.6.
- Is there a fix for CVE-2026-52774?
- Yes. yeswiki/yeswiki (Packagist): upgrade to 4.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-52774 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-52774?
- Check whether you run yeswiki/yeswiki (Packagist) or YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- yeswiki/yeswiki (Packagist): upgrade to 4.6.6 or later
composer require yeswiki/yeswiki:^4.6.6
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in YesWiki's Bazar extension. The vulnerability is located in the `__WidgetHandler.php` and the corresponding template `widget.tpl.html`, where the `id` GET parameter is processed using only `strip_tags()`. Because `strip_tags()` does not escape double quotes, an attacker can break out of HTML attributes like `data-formid` and `data-iframeUrl` to inject arbitrary event handlers (e.g., `onmouseover`). The exploit requires no authentication or valid page permissions and can be triggered by a remote attacker via a crafted URL. The issue is fixed in version 4.6.6.
Affected products
- YesWiki yeswiki < 4.6.6
Identifiers
- CVE-2026-52774
- GHSA-r5xw-gcgw-hwp5
Timeline
- 2026-06-02: disclosed: Initial disclosure to vendor
- 2026-07-09: advisory: GitHub Advisory published
- 2026-07-09: patched: Fix released in version 4.6.6