YesWiki before version 4.5.3 is affected by multiple reflected XSS vulnerabilities. Attackers can exploit unsanitized input parameters (incomingurl, id, file, tags, template) to inject JavaScript code. This can lead to session hijacking and the triggering of authenticated backend requests if victims open maliciously crafted URLs. The CVSS 3.1 base score is 6.1, indicating medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact without availability impact.

Successful exploitation allows remote attackers to inject malicious scripts that can hijack user sessions and perform actions with the privileges of authenticated users. This can compromise user data confidentiality and integrity but does not affect system availability. Both authenticated and unauthenticated users can be targeted via crafted links.

A fix is available in YesWiki version 4.5.3. Users and administrators should upgrade to version 4.5.3 or later to remediate these reflected XSS vulnerabilities. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.