Stored Cross-Site Scripting in BWL Advanced FAQ Manager Lite Plugin for WordPress

CVE-2026-4075

What is CVE-2026-4075?

The BWL Advanced FAQ Manager Lite plugin for WordPress is affected by a vulnerability that allows authenticated users with Contributor-level access and above to exploit insufficient input sanitization and output escaping. This occurs through the 'baf_sbox' shortcode, which improperly handles user-supplied attributes like 'sbox_id' and 'sbox_class'. As a result, attackers can inject arbitrary web scripts into pages, which will execute whenever a user accesses the compromised page, posing serious security risks to site visitors.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References