Stored XSS Vulnerability in phpMyFAQ Affects Open Source FAQ Applications
CVE-2026-34729

6.1MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
2 April 2026

What is CVE-2026-34729?

The phpMyFAQ web application is susceptible to a stored cross-site scripting (XSS) vulnerability caused by a regex bypass in the Filter::removeAttributes() functionality. This issue allows an attacker to inject malicious scripts that can be executed in the context of the user's browser. Versions prior to 4.1.1 are affected, highlighting the importance of updating to the latest version to ensure application security. The vulnerability has been addressed in version 4.1.1, which includes necessary patches to mitigate this risk.

Affected Version(s)

phpMyFAQ < 4.1.1

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
x_refsource_CONFIRM
https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.