The vulnerability allows remote attackers to inject arbitrary JavaScript by manipulating unsanitized URL parameters such as incomingurl, id, file, tags, and template. When a victim opens a crafted link, the attacker‑controlled script runs in the victim’s browser, enabling actions that the victim can perform. This includes hijacking the victim’s session and triggering authenticated requests against backend functionality, effectively allowing the attacker to take advantage of the authenticated user’s privileges within the application.

All deployments of YesWiki that run a version earlier than 4.5.3 are affected. The issue is present in every instance of the YesWiki product, regardless of hosting environment or configuration, as identified in the CNA data. Versions 4.5.3 and later are not vulnerable.

The CVSS score of 5.1 classifies the flaw as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no confirmed exploits have been reported. Attackers simply need to send a user a malicious link and rely on the user clicking it; both authenticated and unauthenticated users can be targeted. The vulnerability does not require local code execution or privileged access, so exploitation is relatively straightforward, but the impact is confined to the victim’s browser and the actions that the victim can perform within the application.