YesWiki EUVD-2026-91476

Exploitation requires the target to run YesWiki before version 4.6.7 and depends on the mail handler endpoint being reachable; the attacker injects via the field parameter, whose value breaks out of the ajax-mail-form action attribute. The primary limiting factor is mandatory user interaction (CVSS UI:A) - a victim must click an attacker-crafted link, making this a phishing/social-engineering-dependent, non-persistent attack rather than autonomous exploitation. No authentication is required of the attacker (PR:N), and the flaw affects the application's handling of the field parameter rather than requiring any special victim-side configuration.

This is a moderate-risk reflected XSS (CWE-79) carrying a vendor/CVSS 4.0 base score of 5.1. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms network-reachable, low-complexity, unauthenticated exploitation but critically requires victim interaction (UI:A) - the attacker must lure a user into clicking a crafted link. Impact is confined to subsequent-system confidentiality and integrity (SC:L/SI:L) with no impact to the vulnerable system itself (VC:N/VI:N/VA:N), consistent with client-side script execution rather than server compromise. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no public exploit identified at time of analysis and no signal of active exploitation; the reflected (non-persistent) nature further limits scale to targeted, per-victim phishing rather than mass exploitation. In short, this is a legitimate but lower-tier priority: real and unauthenticated, but gated by user interaction and lacking any exploitation-probability evidence. A patch is available (4.6.7), making remediation straightforward and the pragmatic response.

An attacker crafts a malicious URL targeting a YesWiki site's mail handler with a field parameter value that breaks out of the ajax-mail-form action attribute and injects JavaScript. The attacker delivers this link via phishing or a malicious post; when a victim clicks it, the script executes in their browser session, enabling session/cookie theft or UI manipulation. No public exploit code is identified at time of analysis, and exploitation requires the victim to interact with the crafted link.