github.com
https://github.com/thorsten/phpMyFAQ CVE-2026-32629
MEDIUM
phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor
Record summary
CVE-2026-32629 has a selected CVSS score of 5.4 (medium).
Description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 (quoted local part) yet contains raw HTML — for example "<script>alert(1)</script>"@evil.com. PHP's FILTER_VALIDATE_EMAIL accepts this email as valid. The email is stored in the database without HTML sanitization and later rendered in the admin FAQ editor template using Twig's |raw filter, which bypasses auto-escaping entirely. This issue has been patched in version 4.1.1.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 2, 2026 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
phpMyFAQBrowse thorsten / phpMyFAQ | CVE List | < 4.1.1 | affected |
phpmyfaq/phpmyfaqBrowse Packagist / phpmyfaq/phpmyfaq | GitHub Advisory | Before 4.1.1 · Fixed in 4.1.1 | affected |
thorsten/phpmyfaqBrowse Packagist / thorsten/phpmyfaq | GitHub Advisory | Before 4.1.1 · Fixed in 4.1.1 | affected |
References
4github.com
https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1 github.comConfirmation
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98gw-w575-h2ph nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-32629