YesWiki, a PHP‑based wiki system, contains a flaw in versions prior to 4.6.6 where Bazar form‑field templates render field.label and field.hint with raw('html'), leading to stored cross‑site scripting when form content is saved and later displayed. The attacker can inject arbitrary HTML or JavaScript that will execute in any user’s browser when the form is rendered, enabling defacement, session hijacking or other malicious actions; this represents CWE‑79 (XSS) and potentially CWE‑116 (Improper Encoding). The impact includes loss of confidentiality, integrity and availability of the wiki content and user sessions.

The vulnerability affects YesWiki deployments running any version older than 4.6.6, specifically the 4.6.5 release series and earlier. Deployments of 4.6.6 or later are considered fixed and do not contain the vulnerable rendering code.

The CVSS score of 5.5 denotes a moderate severity, while EPSS data is not available, making the exploitation likelihood difficult to quantify. The issue is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported to date. The likely attack vector requires the attacker to create or edit a Bazar form, necessitating some level of access to the wiki, but the stored XSS payload will run in any browser that views the form, so the threat remains for publicly accessible deployments until the vendor patch is applied.