The vulnerability is a reflected cross‑site scripting flaw in the mail handler’s field parameter of YesWiki versions prior to 4.6.7. By inserting crafted input, an attacker can break out of the ajax‑mail‑form action and inject JavaScript that executes in the victim’s browser. This flaw is classified under CWE‑79 and allows malicious script execution without authentication, potentially leading to credential theft, session hijacking or defacement.

Affected clients are any installations of YesWiki running a version earlier than 4.6.7. The flaw resides in the YesWiki application component and is specifically tied to the mail‑handler module within the system.

The CVSS score of 5.1 indicates a medium severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting URLs containing malicious field values and convincing users to click them, thereby triggering script execution in the victim’s browser. The exploitation requires no authentication and relies on the victim visiting the manipulated link.