Is CVE-2026-116824 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116824?

CVE-2026-116824 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-116824

Description

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.