Stored Cross-Site Scripting Vulnerability in phpMyFAQ by phpMyFAQ
CVE-2026-111894

5.1MEDIUM

Key Information:

Vendor: Thorsten
Status: pHPMyFAQ
Vendor: CVE Published:; 17 October 2026

What is CVE-2026-111894?

A stored cross-site scripting vulnerability exists in phpMyFAQ versions prior to 4.1.9 and 4.2.0-beta. This vulnerability allows authenticated content authors to embed JavaScript through iframes with data:text/html sources in FAQ or News content. Attackers can exploit this flaw to evade security restrictions, enabling the execution of arbitrary scripts, potentially leading to phishing attacks and top-frame redirects for users accessing the affected content.

Affected Version(s)

phpMyFAQ 3.2.1 < 4.1.9

phpMyFAQ 4.2.0-alpha < 4.2.0-beta

phpMyFAQ 4.1.9

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...

vendor-advisory

https://www.vulncheck.com/advisories/phpmyfaq-3.2.1-befor...

third-party-advisory

CVSS V4

Score:

5.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 17, 2026
Vulnerability Reserved
Oct 17, 2026

Credit

nirtem

CVE-2026-111894 Data

JSON