A stored and blind cross‑site scripting flaw exists in the form title field of YesWiki, allowing an unauthenticated attacker to inject JavaScript that is subsequently executed when any user opens the affected page. This can lead to client‑side code execution, facilitating cookie theft, session hijacking, defacement, or redirection to malicious sites.

The vulnerability affects all YesWiki installations running versions prior to 4.6.0. Users of YesWiki older than the v4.6.0 release are at risk, while installations updated to 4.6.0 or later are safe.

The CVSS score of 7.1 indicates a moderate to high severity, and the EPSS score of less than 1 percent suggests a low probability of exploitation in the wild. Since the flaw can be triggered without authentication, an attacker only needs to create a malicious form title and await a victim to open the page. The issue is not listed in the CISA KEV catalog.