Cross-site Scripting in ThemeHigh Advanced FAQ Manager
CVE-2025-67556

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Advanced Faq Manager
Vendor
CVE Published:
9 December 2025

What is CVE-2025-67556?

The ThemeHigh Advanced FAQ Manager plugin suffers from a Cross-site Scripting (XSS) vulnerability, allowing attackers to inject malicious scripts via improperly sanitized user input during web page generation. The vulnerability affects all versions up to and including 1.5.2, opening the door for stored XSS attacks that can compromise user sessions and lead to unauthorized access. WordPress users should ensure they are using updated versions of this plugin to safeguard against potential exploitation.

Affected Version(s)

Advanced FAQ Manager 0 <= 1.5.2

References

https://patchstack.com/database/Wordpress/Plugin/advanced...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan | Patchstack Bug Bounty Program
.