YesWiki is vulnerable to a reflected cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript into the page by manipulating the unescaped `id` GET parameter of the Bazar widget. The improper use of strip_tags() permits an attacker to break out of an HTML attribute and insert an event handler such as `onmouseover`. An attacker can therefore cause any code to run in the victim’s browser, which can lead to data theft, session hijacking, or defacement. The vulnerability is not limited to authenticated users and can be exploited by simply accessing a URL that contains the id parameter.

The flaw exists in YesWiki versions older than 4.6.6 when the Bazar extension is enabled. Any page that calls the widget endpoint with an `id` query string is affected. The vulnerability applies to both valid and nonexistent page routes. All installations that use the default YesWiki distribution with the Bazar component before the 4.6.6 release should be considered vulnerable.

The CVSS score of 6.1 indicates a medium severity. There is no EPSS score available, and the flaw is not listed in CISA’s KEV catalog. The vulnerability can be triggered without authentication, requiring only that the Bazar extension be active and that an attacker delivers a crafted URL containing the id parameter. Any public user who follows such a link would have the injected JavaScript executed in their browser. Because the flaw exposes a serialization of the id parameter directly into the DOM, the risk remains high for any untrusted users visiting the site.