CVE-2026-46363: phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46363?
CVE-2026-46363 has a high severity rating due to its potential for exploitation through stored cross-site scripting vulnerabilities.
How do I fix CVE-2026-46363?
To fix CVE-2026-46363, upgrade phpMyFAQ to version 4.1.2 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-46363?
CVE-2026-46363 affects all versions of phpMyFAQ prior to 4.1.2.
What type of vulnerability is CVE-2026-46363?
CVE-2026-46363 is a stored cross-site scripting (XSS) vulnerability.
What can an attacker do with CVE-2026-46363?
An authenticated attacker with the FAQ_ADD permission can exploit CVE-2026-46363 to execute arbitrary scripts in the context of another user's session.