Stored Cross-Site Scripting in WP Easy FAQs Plugin for WordPress

CVE-2025-8686

What is CVE-2025-8686?

The WP Easy FAQs plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping on user-supplied data through the WP_EASY_FAQ shortcode. This vulnerability allows authenticated users with author-level access or higher to inject malicious scripts into FAQ sections. When other users access these compromised pages, the injected scripts can be executed, posing significant risks to site security and user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References