Is CVE-2026-116206 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116206?

CVE-2026-116206 has a CVSS v3 severity of MEDIUM (6.4).

Back

CVE-2026-116206

Description

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.