CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774 is a reflected XSS vulnerability in YesWiki's Bazar widget handler. The query parameter in the NoSuchPage/widget endpoint is inadequately sanitized using strip_tags(), which does not escape double quotes. This allows an attacker to break out of HTML attributes and inject JavaScript event handlers, such as onmouseover, into the data-iframeUrl attribute.

The vulnerability was patched in version 4.6.6 by adding urlencode() to the $urlParams in the __WidgetHandler method.

🔬 Vulnerability Details

Root Cause

The vulnerability exists in the __WidgetHandler method of YesWiki's Bazar extension. The query parameter is passed through strip_tags() but not properly URL-encoded before being embedded into the data-iframeUrl attribute.

Exploit Chain

1. Attacker crafts URL with malicious query parameter
   ↓
2. User clicks malicious link or visits crafted page
   ↓
3. Server reflects payload into data-iframeUrl attribute
   ↓
4. User hovers over widget area
   ↓
5. JavaScript executes (onmouseover event)
   ↓
6. Attacker steals session cookies or performs actions as user
   ↓
7. Further exploitation via CVE-2026-52777 (unserialize RCE)