Stored Cross-Site Scripting in phpMyFAQ Affects User Security
CVE-2026-85593

5.1MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85593?

A stored cross-site scripting vulnerability exists in phpMyFAQ versions prior to 4.1.8 due to improper handling of sanitized content in the FaqHelper::convertOldInternalLinks() function. This vulnerability allows authenticated users with editing privileges to inject JavaScript payloads into FAQ entries. When other users access these pages, the malicious scripts are executed in their browsers, potentially compromising user data and security.

Affected Version(s)

phpMyFAQ 0 < 4.1.8

phpMyFAQ 4.1.8

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1....
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

pavelkohout396
.