CVE-2026-85593: phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls htmlentitydecode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Stored XSS via html_entity_decode
Event History
Frequently Asked Questions
Who can exploit this issue and who is exposed to the injected script?
An authenticated user with FAQ editing privileges can inject the payload. The script can execute in the browsers of all users who view an affected FAQ page.
Which deployments are affected?
phpMyFAQ versions before 4.1.8 are affected. The issue is reached when FAQ content is processed by FaqHelper::convertOldInternalLinks().
What is the immediate mitigation if upgrading is not possible?
Restrict FAQ editing privileges to trusted users, because those privileges are required to inject the stored payload.