Yada Wiki Vulnerabilities

The Yada Wiki plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil...

CVSS:

6.4

Affected:

up to 3.5

Fixed in:

3.6

Disclosed:

Dec 30, 2025

CVE-2025-66094 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yada Wiki yada-wiki allows Stored XSS.This issue affects Yada Wiki: from n/a through 3.5.

Affected:

up to 3.5

Fix:

No patched version reported

Disclosed:

Dec 30, 2025

CVE-2025-66094 on NVD →

[en] The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored Cross-Site Scripting issue

Affected:

up to 3.4.1

Fixed in:

3.4.1

Disclosed:

Aug 2, 2021

CVE-2021-24470 on NVD →

The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored Cross-Site Scripting issue

CVSS:

5.4

Affected:

up to 3.4.1

Fixed in:

3.4.1

Disclosed:

Jun 28, 2021

CVE-2021-24470 on NVD →