YesWiki's Bazar widget handler reflects the `id` GET parameter into HTML attributes (`data-formid` and `data-iframeUrl`) using `strip_tags()` which only removes HTML tags but does not escape special characters like double quotes. This allows an attacker to break out of the attribute context and inject event handlers such as `onmouseover`, resulting in reflected XSS. The vulnerable route requires only the presence of the `id` parameter and the Bazar extension enabled; it performs no authentication or authorization checks. The vulnerability was confirmed on YesWiki version 4.6.5. The issue enables arbitrary JavaScript execution in the context of the YesWiki origin, affecting both unauthenticated and authenticated users.

An attacker can execute arbitrary JavaScript in the browser of any user who visits a crafted URL on a vulnerable YesWiki instance with Bazar enabled. This can lead to theft of sensitive browser-accessible data, session hijacking, and actions performed on behalf of the victim. The vulnerability requires no authentication or permissions and affects public visitors and logged-in users alike. There is no indication of denial of service or server-side impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the Bazar extension if it is not needed or implement web application firewall (WAF) rules to detect and block suspicious requests targeting the `id` parameter in the widget route. Avoid exposing the vulnerable endpoint to untrusted users. Monitor official YesWiki channels for updates and apply official fixes once released.