UpHeron
All vulnerabilities

Servers and applications

CVE-2025-46346

Stored XSS in Comments

Severity
Medium 6.3
Published
28 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
4.5.4
Also known as
GHSA-59x8-cvxh-3mm4
Sources
NVD, Project advisories (GitHub)

Description

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting (XSS) vulnerability was discovered in the application’s comments feature. This issue allows a malicious actor to inject JavaScript payloads that are stored and later executed in the browser of any user viewing the affected comment. The XSS occurs because the application fails to properly sanitize or…

Affected software

SoftwareAffected versions
YesWikiServers and applications · cpe:a:yeswiki:yeswiki
  • Every version before 4.5.4
YesWikiServers and applications · github:yeswiki/yeswiki
  • Every version before 4.5.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-46346
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-46346
  • GitHub Advisory Database https://github.com/advisories/GHSA-59x8-cvxh-3mm4
  • github.com https://github.com/YesWiki/yeswiki/security/advisories/GHSA-59x8-cvxh-3mm4