What’s Vulnerable › Vulnerabilities

CVE-2026-46363: phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-15 · updated 2026-10-26
• Weakness: CWE-79

Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.

Affected products

• thorsten phpMyFAQ: before 4.1.2 — fixed in 4.1.2

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f5p7-2c9q-8896
• https://www.vulncheck.com/advisories/phpmyfaq-stored-xss-in-faq-question-answer-via-encode-decode-bypass
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f5p7-2c9q-8896

Get alerted when CVE-2026-46363 or the next vulnerability affects your stack