This vulnerability is a stored cross‑site scripting flaw in YesWiki before version 4.6.7. It exists in the formatters/wakka.php module and allows an attacker who can edit a page or post a comment to inject event handlers by inserting quote characters into markdown image URLs. The crafted markdown image breaks out of the src attribute and introduces an onerror handler that executes arbitrary JavaScript whenever a page is viewed, affecting all users including site administrators.

All installations of YesWiki using the yeswiki product and running any version earlier than 4.6.7 are affected. The vulnerability applies to the default markdown image rendering mechanism provided by the wakka.php formatter.

The CVSS score of 5.1 classifies the flaw as moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating it has not been confirmed in the wild yet. Exploitation requires an attacker to have write access to the target wiki, such as permission to edit pages or post comments. Once the malicious markdown image is stored, any user who views the affected page will have the injected JavaScript executed in their browser, leading to hijacked sessions, credential theft, or defacement.