Detections
Analytics
CVE-2026-46363
medium
Description
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.
References
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f5p7-2c9q-8896