CVE-2026-46363
MEDIUMphpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass
Title source: cnaDescription
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GHSA Advisory GHSA-f5p7-2c9q-8896
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f5p7-2c9q-8896
Third Party Advisory third-party-advisory
VulnCheck Advisory: phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass
https://www.vulncheck.com/advisories/phpmyfaq-stored-xss-in-faq-question-answer-via-encode-decode-bypass
Scores
CVSS v3
5.4
EPSS
0.0015
EPSS Percentile
4.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (6)
phpMyFAQ/phpMyFAQ
0 - 4.1.2Packagist
phpmyfaq/phpmyfaq
0 - 4.1.2Packagist
thorsten/phpmyfaq
< 4.1.2
thorsten/phpMyFAQ
0 - 4.1.2Packagist
thorsten/phpmyfaq
0 - 4.1.2Packagist
thorsten/phpmyfaq
4.1.2
Published
May 15, 2026
Tracked Since
May 16, 2026